diff --git a/README.org b/README.org index 3a63609..3e208f7 100644 --- a/README.org +++ b/README.org @@ -6,26 +6,32 @@ \033[32m---- SQL injection demo ----\[\033[33m\033[0m\] $?:$ ' - + # Build ./build.sh # Prepare db + ./admin rm-db ./admin create-db ./admin show-db # Add regular user interactively ./add-user 2>> users.log + First User + + + # Check ./admin show-db # Regular user via "external" process - echo "sample user" | ./add-user 2>> users.log + echo "User Outside" | ./add-user 2>> users.log ./admin show-db # Add Johnny Droptable ./add-user 2>> users.log Johnny'); DROP TABLE users; -- + # And the problem: ./admin show-db diff --git a/admin b/admin index b6b5bbe..a9b10ea 100755 --- a/admin +++ b/admin @@ -1,4 +1,8 @@ #!/bin/bash +rm-db () { + rm users.sqlite +} + create-db () { echo ' CREATE TABLE users ( diff --git a/dataflow.key b/dataflow.key index 1d4bd30..a7220b5 100644 Binary files a/dataflow.key and b/dataflow.key differ