On some web pages, sqlmap is unable to enumerate list of tables

[hasksomatotoian]

For some web applications, sqlmap returns invalid result when evaluating list of tables. This happens when the web application displays the sqlmap payload at the start of the page. See the attached screenshot.

Steps to reproduce

1. Start PortSwigger lab Lab: SQL injection UNION attack, determining the number of columns returned by the query
2. Run sqlmap using command:
   sqlmap -u https://<lab_guid>.web-security-academy.net/filter?category=<category> -D public --tables
3. You will get following result:

Database: public
[1 table]
+---------------------------------------------------------+
| '||COALESCE(tablename::text,' ')||' |
+---------------------------------------------------------+

Expected behavior

You should get list of tables in the "public" database:

Database: public
[1 table]
+----------+
| products |
+----------+

Screenshots

Running environment

• sqlmap version 1.4.12#stable
• Installation method: apt-get
• Operating system: kali
• Python version: 3.8.7

Target details

• DBMS: PostgreSQL
• SQLi techniques found by sqlmap: UNION query
• WAF/IPS: N/A
• Relevant console output: see attached file
• Exception traceback: N/A

[stamparm]

This is issue introduced with the #4403. It seems that in case of JSON aggregation there is no (expected) escaping of quoted strings