Fixes #6123

lib/controller/controller.py

@@ -376,6 +376,11 @@ def start():
     for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets:
         targetCount += 1
 
+        # --report-json: give each target its own taskid in the shared collector, so a multi-target
+        # run (e.g. '-m' bulk file) doesn't have later targets overwrite earlier ones (see _reportData)
+        if conf.reportJson:
+            kb.reportTaskId = targetCount
+
         try:
             if conf.checkInternet:
                 infoMsg = "checking for Internet connection"

lib/core/dump.py

@@ -108,11 +108,15 @@ class Dump(object):
         collector is active - which is only ever the case for a CLI --report-json run, never under
         --api - so this never double-captures alongside StdDbOut. A None content_type is resolved
         via the kb.partRun fallback (e.g. the fingerprint line), mirroring the API exactly.
+
+        Keyed by kb.reportTaskId rather than the fixed REPORT_TASKID so that a multi-target run
+        (e.g. '-m' bulk file) keeps each target's results separate instead of later targets
+        overwriting earlier ones under the same content_type.
         """
 
         if conf.get("reportCollector") is not None:
             from lib.utils.api import _storeData, REPORT_TASKID
-            _storeData(conf.reportCollector, REPORT_TASKID, stdoutEncode(clearColors(data)), CONTENT_STATUS.COMPLETE, content_type)
+            _storeData(conf.reportCollector, kb.get("reportTaskId", REPORT_TASKID), stdoutEncode(clearColors(data)), CONTENT_STATUS.COMPLETE, content_type)
 
     def flush(self):
         if self._outputFP:

lib/core/settings.py

@@ -20,7 +20,7 @@ from lib.core.enums import OS
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.9.12"
+VERSION = "1.10.9.13"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

lib/utils/api.py

@@ -265,9 +265,19 @@ def writeReportJson(collector, filepath):
     """
     Writes the collected results to filepath as JSON, in the same shape as the REST API's
     /scan/<id>/data response, wrapped with a small 'meta' block for standalone consumers.
+
+    A multi-target run (e.g. '-m' bulk file) stores each target under its own taskid (see
+    kb.reportTaskId), so every taskid present in the collector is assembled here; a single-target
+    run still yields exactly one taskid and keeps the flat {success, data, error} shape.
     """
 
-    result = _assembleData(collector, REPORT_TASKID)
+    taskids = sorted(row[0] for row in collector.execute("SELECT DISTINCT taskid FROM data")) or [REPORT_TASKID]
+
+    if len(taskids) > 1:
+        result = {"success": True, "targets": [_assembleData(collector, taskid) for taskid in taskids]}
+    else:
+        result = _assembleData(collector, taskids[0])
+
     result["meta"] = {
         "api_version": int(RESTAPI_VERSION.split(".")[0]),   # MAJOR only - the part that matters for client compatibility
         "sqlmap_version": VERSION_STRING,
@@ -467,7 +477,8 @@ class ReportErrorRecorder(logging.Handler):
 
     def emit(self, record):
         try:
-            self.collector.execute("INSERT INTO errors VALUES(NULL, ?, ?)", (REPORT_TASKID, str(record.msg % record.args if record.args else record.msg)))
+            taskid = kb.get("reportTaskId", REPORT_TASKID)
+            self.collector.execute("INSERT INTO errors VALUES(NULL, ?, ?)", (taskid, str(record.msg % record.args if record.args else record.msg)))
         except Exception:
             pass