"if not" gets folded into bareword

[sshayb]

The following payload:

'; if not((select serverproperty('isintegratedsecurityonly')) <> 1) waitfor delay '0:0:2' --

was tokenized previously into "s;To(E" and detected. After the latest change in syntax_merge_words
function and addition of "a->type == TYPE_TSQL", the "To" tokens are merged into "n" token; no detection as a result. Was that the intention? Seems like a side-effect of begin-try change.

[hongpinglin]

Just curious, what would be the attack for this pattern in the web applications' context.

My understanding is that statement after ";" must be TSQL (insert, drop, or update) in order to form a syntax correct sql. Any idea?

[sshayb]

Yeah, not sure about that. But I'm pretty sure the "To" to "n" merging occurs regardless of the previous context, so it doesn't have to be specifically ";" there.

[client9]

this was a good one! thanks for the report. This is fixed on HEAD and will be out in next release.