SQLMap fails to dump LONGTEXT/XML column via UNION (truncated output / SQL syntax errors)
bug report
### Description
When dumping a column containing large XML/JSON data, sqlmap detects a working UNION injection but fails to dump the column correctly. The tool reports truncated output or SQL syntax errors.
### Environment
* sqlmap version: (e.g. 1.8.x / latest from GitHub)
* Python version: (e.g. Python 3.12)
* OS: Windows 10
* DBMS: MySQL
* Injection type detected: UNION query (NULL) – 20 columns
### Command used
```
sqlmap -u "TARGET_URL" \
--technique=U \
--union-cols=20 \
--threads=5 \
-D DATABASE -T TABLE -C COLUMN \
--dump
```
### Observed behavior
sqlmap detects UNION injection successfully:
```
Type: UNION query
Title: MySQL UNION query (NULL) - 20 columns
```
However when dumping the column containing large XML/JSON data, sqlmap returns errors such as:
```
possible server trimmed output detected (probably due to its length and/or content)
```
and sometimes:
```
Uncaught mysqli_sql_exception: You have an error in your SQL syntax near '[{"xml": "<?xml version="1.0"...'
```
### Workaround
Using boolean-based extraction works:
```
--technique=B
```
But the extraction becomes extremely slow.
### Expected behavior
Since UNION-based injection is confirmed working, sqlmap should ideally handle long column values (XML/JSON) without truncation or syntax errors, or automatically switch to a safer extraction method.
### Additional information
The column contains serialized API responses beginning with:
```
[{"xml": "<?xml version="1.0" encoding="UTF-8"?>
```
which may exceed the HTTP response length or break SQL syntax during UNION extraction.
0 条评论