Skip to content

SQL注入并未成功检测 #2

@Cl0udG0d

Description

@Cl0udG0d

你好,在Sqliscan文件夹下的sqlerrors.py文件中,check()函数传入了html参数,但是在匹配中仅仅是re.compile(error),没有与html相联系起来,我觉得这里应该是写漏了,建议修改为:
pattern=re.compile(error,re.I)
if pattern.findall(source):
return True, db

如果不修改的话,每一次扫描到有参数的地方,都会显示MySQL数据库存在注入,望修改:-)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions