[sqlmap-users] SqlMap thinks function REPLACE is fields in a query
Brought to you by:
inquisb
From: Ole R. <ol...@gm...> - 2010-04-02 16:16:47
|
I believe there's a bug when executing the following via sql-shell: "SELECT REPLACE('something', 's', 'b')" The result is: [INFO] the SQL query provided has more than a field. sqlmap will now unpack it into distinct queries to be able to retrieve the output even if we are going blind and then it returns nothing. This is clearly incorrect - looks like SqlMap thinks it's a list of fields. |