Fix for MSSQL row retrieval losing duplicates (OFFSET/FETCH for 2012+ and Azure)

Author: stamparm

lib/core/agent.py

@@ -1267,6 +1267,11 @@ def limitQuery(self, num, query, field=None, uniqueField=None):
                 orderBy = limitedQuery[limitedQuery.index(" ORDER BY "):]
                 limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")]
 
+            # Note: Microsoft SQL Server 2012+ (and Azure) supports OFFSET/FETCH (row position based), while the (old) NOT IN forging is value based (i.e. collapses duplicate values)
+            if Backend.isDbms(DBMS.MSSQL) and (Backend.isVersionGreaterOrEqualThan("2012") or Backend.isVersionWithin(("Azure",))) and not re.search(r"(?i)\A(SELECT\s+)?(TOP|DISTINCT)\b", limitedQuery):
+                limitedQuery = "%s%s OFFSET %d ROWS FETCH NEXT 1 ROWS ONLY" % (limitedQuery, orderBy or " ORDER BY %s" % (uniqueField or '1'), num)
+                return limitedQuery
+
             notDistincts = re.findall(r"DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I)
 
             for notDistinct in notDistincts:

lib/core/settings.py

@@ -19,7 +19,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.11.24"
+VERSION = "1.10.11.25"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)