Fixes #5203

Author: stamparm

lib/core/settings.py

@@ -20,7 +20,7 @@
 from thirdparty.six import unichr as _unichr
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.6.10.6"
+VERSION = "1.6.10.7"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

tamper/htmlencode.py

@@ -20,6 +20,12 @@ def tamper(payload, **kwargs):
 
     >>> tamper("1' AND SLEEP(5)#")
     '1' AND SLEEP(5)#'
+    >>> tamper("1' AND SLEEP(5)#")
+    '1' AND SLEEP(5)#'
     """
 
-    return re.sub(r"[^\w]", lambda match: "&#%d;" % ord(match.group(0)), payload) if payload else payload
+    if payload:
+        payload = re.sub(r"&#(\d+);", lambda match: chr(int(match.group(1))), payload)      # NOTE: https://github.com/sqlmapproject/sqlmap/issues/5203
+        payload = re.sub(r"[^\w]", lambda match: "&#%d;" % ord(match.group(0)), payload)
+
+    return payload