Skip to content

Access Database Comment Character %16 #468

Closed

Description

@irsdl

Hello
We need to have %16 for MS Access databases as %00 does not normally work specially in ASP language that terminates the string before passing it to the database query. Therefore, %16 is more generic than %00 for MS Access comment (https://www.owasp.org/index.php/Testing_for_MS_Access).

These are the lines that need to be changed:

File: lib/core/agent.py - Line 221
if Backend.getIdentifiedDbms() == DBMS.ACCESS and comment == GENERIC_SQL_COMMENT:
comment = "%16"

File: xml/queries.xml - Line 358
comment query="%16" query2="%00"

Thanks
Soroush

Activity

  1. added a commit that references this issue on Jun 21, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions