GRADE XII - HACKATHON ACTIVITY

 # ---

# File: main.py

# The functions defined in this file have

# two major vulnerabilites. It is you job

# to find them and fix them.

# Document the vulnerability and research

# about it.

# Hint: Check the `execute` method calls.

#

#

# Run `pip install "fastapi[standard]"` (or `pip3`)

# ---

from fastapi import FastAPI

import sqlite3

# FastAPI is used to create the API

# for the application. It is not a

# part of the vulnerability.

#

# Read More: https://fastapi.tiangolo.com/

app = FastAPI()

db = sqlite3.connect("main.sqlite")

cursor = db.cursor()

cursor.execute("CREATE TABLE IF NOT EXISTS users (username TEXT, password TEXT)")

cursor.execute("CREATE TABLE IF NOT EXISTS items (user_name TEXT)")

db.commit()

db.close()

"""

One of the vulnerabilities is present

in this function.

"""

@app.get("/auth/email")

async def login(username: str, password: str):

    db = sqlite3.connect("main.sqlite")

    cursor = db.cursor()

    cursor.execute(

        "SELECT * FROM users WHERE username = '%s' AND password = '%s'"

        % (username, password)

    )

    result = cursor.fetchone()

    if result:

        return {"message": "Login successful"}

    else:

        return {"message": "Invalid username or password"}

"""

The other instance of that vulnerability

is present in this function.

"""

@app.get("/items")

async def get_items(user_name, token):

    db = sqlite3.connect("main.sqlite")

    cursor = db.cursor()

    cursor.execute("SELECT * FROM items WHERE user_name = '%s'" % (user_name))

    result = cursor.fetchall()

    if result:

        return {"message": "Success"}

    else:

        return {"message": "No items found"}

"""

This is a helper function. This is

not a part of the vulnerability.

"""

@app.get("/register")

async def register(username, password):

    db = sqlite3.connect("main.sqlite")

    cursor = db.cursor()

    cursor.execute(

        "SELECT * FROM users WHERE username = '%s' AND password = '%s'"

        % (username, password)

    )

    result = cursor.fetchone()

    if result:

        return {"message": "User already exists"}

    else:

        cursor.execute(

            "INSERT INTO users (username, password) VALUES ('%s', '%s')"

            % (username, password)

        )

        db.commit()

        return {"message": "User created successfully"}

LINK:

PASTEBIN