Update SQLIController.cs

RandomQuotes/Controllers/SQLIController.cs

@@ -3,25 +3,40 @@
 using System.IO;
 using System.Text;
 using Microsoft.AspNetCore.Mvc;
-using System.Data.SQLite;  
+using System.Data.SQLite;
+using System.Linq;
+using Microsoft.AspNetCore.Http.Extensions;
 
 
 namespace RandomQuotes.Controllers
 {
     public class SQLIController : Controller
     {
         // testing normal: /sqli?name=Andrew
-        // testing exploit: /sqli?name=1%27%20or%20%271%27==%271
+        // testing exploit: /sqli?name=Octopus%27%20or%20%271%27==%271
         [HttpGet("sqli")]
         public IActionResult Get(string name)
         {
-            SQLiteConnection conn = new SQLiteConnection("Data Source=Chinook_Sqlite.sqlite");  
-            conn.Open();  
-
-            SQLiteCommand cmd = new SQLiteCommand(conn);  
-            cmd.CommandText = "select * from Employee where FirstName == '" + name + "';";
+            string clause = "";
+            List<string> list = new List<string>();
+            if (name.StartsWith("Octopus"))
+            {
+                list.Add("FirstName == '" + name + "';");
+            }
+            else
+            {
+                list.Add("FirstName == 'Andrew';");
+            }
+
+            SQLiteConnection conn2 = new SQLiteConnection("Data Source=Chinook_Sqlite.sqlite");  
+            conn2.Open();  
 
-            SQLiteDataReader reader = cmd.ExecuteReader();  
+            SQLiteCommand cmd2 = new SQLiteCommand(conn2);  
+            string whereClause = "where " + string.Join(" OR ", list);
+
+            cmd2.CommandText = "select * from Employee " + whereClause;
+            Console.WriteLine(cmd2.CommandText);
+            SQLiteDataReader reader = cmd2.ExecuteReader();  
 
 
             List<string> res = new List<string>();
@@ -40,4 +55,4 @@
             return Ok(res);
         }
     }
-}
+}