Failure to inject on headers if content-length is missing in a GET

[tmendo]

Describe the bug
sqlmap fails to detect header injection locations on GET requests that do not have the content-length header.

To Reproduce

1. Create the following file x.req

GET / HTTP/1.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9*
accept-encoding: gzip, deflate
cache-control: no-cache
pragma: no-cache
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (compatible) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.0.0 Safari/537.36
Host: example.com

2. run python sqlmap.py -r x.req -p accept

The output is

[00:09:56] [INFO] parsing HTTP request from 'x.req'
[00:09:56] [CRITICAL] specified file 'x.req' does not contain a usable HTTP request (with parameters)

Screeshots

tmendo@mau:sqlmap$ cat x.req 
GET / HTTP/1.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9*
accept-encoding: gzip, deflate
cache-control: no-cache
pragma: no-cache
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (compatible) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.0.0 Safari/537.36
Host: example.com

tmendo@mau:sqlmap$ python sqlmap.py -r x.req -p accept
        ___
       __H__
 ___ ___[']_____ ___ ___  {1.7.2.22#dev}
|_ -| . [(]     | .'| . |
|___|_  [,]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:17:44 /2023-03-06/

[00:17:44] [INFO] parsing HTTP request from 'x.req'
[00:17:44] [CRITICAL] specified file 'x.req' does not contain a usable HTTP request (with parameters)

[*] ending @ 00:17:44 /2023-03-06/

tmendo@mau:sqlmap$ cat x2.req 
GET / HTTP/1.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9*
accept-encoding: gzip, deflate
cache-control: no-cache
pragma: no-cache
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (compatible) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.0.0 Safari/537.36
Host: example.com
content-length: 0

tmendo@mau:sqlmap$ python sqlmap.py -r x2.req -p accept
        ___
       __H__
 ___ ___[(]_____ ___ ___  {1.7.2.22#dev}
|_ -| . [(]     | .'| . |
|___|_  [.]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 00:17:51 /2023-03-06/

[00:17:51] [INFO] parsing HTTP request from 'x2.req'
[00:17:51] [INFO] testing connection to the target URL
[00:17:51] [INFO] testing if the target URL content is stable
[00:17:52] [INFO] target URL content is stable
[00:17:52] [WARNING] heuristic (basic) test shows that (custom) HEADER parameter 'accept' might not be injectable
[00:17:52] [INFO] testing for SQL injection on (custom) HEADER parameter 'accept'
[00:17:52] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[00:17:53] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[00:17:53] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[00:17:54] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[00:17:55] [WARNING] user aborted during detection phase
how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit] q
[00:17:57] [ERROR] user quit

[*] ending @ 00:17:57 /2023-03-06/

tmendo@mau:sqlmap$ python -V
Python 3.9.1
tmendo@mau:sqlmap$ uname -a
Darwin mau.localdomain 22.3.0 Darwin Kernel Version 22.3.0: Mon Jan 30 20:39:35 PST 2023; root:xnu-8792.81.3~2/RELEASE_ARM64_T8103 arm64
tmendo@mau:sqlmap$ 

Expected behavior

sqlmap should be able to inject in the accept header.

The output should have been

[00:10:54] [INFO] parsing HTTP request from 'x2.req'
[00:10:54] [INFO] testing connection to the target URL
[00:10:54] [INFO] testing if the target URL content is stable
[00:10:55] [INFO] target URL content is stable
[00:10:55] [WARNING] heuristic (basic) test shows that (custom) HEADER parameter 'accept' might not be injectable

If you use the file x2.req as input, as follows, sqlmap will inject in the accept header, as expected:

GET / HTTP/1.1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9*
accept-encoding: gzip, deflate
cache-control: no-cache
pragma: no-cache
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: none
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (compatible) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.0.0 Safari/537.36
Host: example.com
content-length: 0

Running environment:

• sqlmap version 1.7.2.22#dev
• Installation method git clone https://github.com/sqlmapproject/sqlmap.git
• Operating system: OS X Ventura 13.2.1
• uname -a Darwin mau.localdomain 22.3.0 Darwin Kernel Version 22.3.0: Mon Jan 30 20:39:35 PST 2023; root:xnu-8792.81.3~2/RELEASE_ARM64_T8103 arm64
• Python version Python 3.9.1

Target details:
Any target, used example.com for the issue.

[stamparm]

sqlmap is able to injection into the Accept header, but not into that "problematic" "q=..." attribute. That same attribute is in 99.99% of cases perfectly valid to contain the * inside of its value (e.g. q=0.9, */*)

won't change anything in the current sqlmap's workflow related to this "issue"

[tmendo]

I just want to restate that it only stops working when the content-length is not present, which is optional for this request :)