Minor patches for -d

Author: stamparm

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.81"
+VERSION = "1.10.7.82"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

plugins/dbms/cache/connector.py

@@ -46,7 +46,7 @@ def connect(self):
         try:
             driver = 'com.intersys.jdbc.CacheDriver'
             connection_string = 'jdbc:Cache://%s:%d/%s' % (self.hostname, self.port, self.db)
-            self.connector = jaydebeapi.connect(driver, connection_string, str(self.user), str(self.password))
+            self.connector = jaydebeapi.connect(driver, connection_string, [str(self.user), str(self.password)])
         except Exception as ex:
             raise SqlmapConnectionException(getSafeExString(ex))
 

plugins/dbms/cubrid/connector.py

@@ -30,8 +30,10 @@ def connect(self):
         self.initConnection()
 
         try:
-            self.connector = CUBRIDdb.connect(hostname=self.hostname, username=self.user, password=self.password, database=self.db, port=self.port, connect_timeout=conf.timeout)
-        except CUBRIDdb.DatabaseError as ex:
+            # CUBRIDdb.connect takes a positional URL 'CUBRID:host:port:db:::' then user/password positionally
+            # (it does not accept hostname/username/database keyword args, which raised a TypeError before)
+            self.connector = CUBRIDdb.connect("CUBRID:%s:%s:%s:::" % (self.hostname, self.port, self.db), str(self.user), str(self.password))
+        except Exception as ex:
             raise SqlmapConnectionException(getSafeExString(ex))
 
         self.initCursor()

plugins/dbms/hsqldb/connector.py

@@ -45,8 +45,8 @@ def connect(self):
 
         try:
             driver = 'org.hsqldb.jdbc.JDBCDriver'
-            connection_string = 'jdbc:hsqldb:mem:.'  # 'jdbc:hsqldb:hsql://%s/%s' % (self.hostname, self.db)
-            self.connector = jaydebeapi.connect(driver, connection_string, str(self.user), str(self.password))
+            connection_string = 'jdbc:hsqldb:hsql://%s:%s/%s' % (self.hostname, self.port, self.db)  # was hardcoded to 'jdbc:hsqldb:mem:.' (a fresh empty in-memory DB), ignoring the -d target
+            self.connector = jaydebeapi.connect(driver, connection_string, [str(self.user), str(self.password)])
         except Exception as ex:
             raise SqlmapConnectionException(getSafeExString(ex))
 

plugins/dbms/mimersql/connector.py

@@ -30,8 +30,10 @@ def connect(self):
         self.initConnection()
 
         try:
-            self.connector = mimerpy.connect(hostname=self.hostname, username=self.user, password=self.password, database=self.db, port=self.port, connect_timeout=conf.timeout)
-        except mimerpy.OperationalError as ex:
+            # mimerpy.connect uses dsn/user/password (host/port come from Mimer's sqlhosts/MIMER_DATABASE
+            # configuration, not connect() kwargs); the previous hostname/username/... kwargs raised a TypeError
+            self.connector = mimerpy.connect(dsn=self.db, user=str(self.user), password=str(self.password))
+        except Exception as ex:
             raise SqlmapConnectionException(getSafeExString(ex))
 
         self.initCursor()

plugins/dbms/oracle/connector.py

@@ -32,6 +32,14 @@ class Connector(GenericConnector):
     def connect(self):
         self.initConnection()
 
+        # Fetch CLOB/BLOB values directly as str/bytes instead of oracledb.LOB objects; otherwise a LOB cell
+        # reached the renderer as the repr '<oracledb.LOB object at 0x...>' (BLOB bytes are then hex-encoded
+        # by direct()'s binary handling).
+        try:
+            oracledb.defaults.fetch_lobs = False
+        except AttributeError:
+            pass
+
         self.user = getText(self.user)
         self.password = getText(self.password)
 

plugins/dbms/vertica/connector.py

@@ -44,16 +44,21 @@ def fetchall(self):
             logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex))
             return None
 
-    def execute(self, query):
+    def execute(self, query, commit=True):
         try:
             self.cursor.execute(query)
         except (vertica_python.OperationalError, vertica_python.ProgrammingError) as ex:
             logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % getSafeExString(ex))
         except vertica_python.InternalError as ex:
             raise SqlmapConnectionException(getSafeExString(ex))
 
-        self.connector.commit()
+        # commit non-SELECT (DML) here; select() commits only AFTER fetchall() because vertica_python shares one
+        # cursor per connection and commit() runs COMMIT through it, discarding the unfetched result set
+        if commit:
+            self.connector.commit()
 
     def select(self, query):
-        self.execute(query)
-        return self.fetchall()
+        self.execute(query, commit=False)
+        retVal = self.fetchall()
+        self.connector.commit()
+        return retVal