SQLite .NET Wrapper Executes Multiple Statements via ExecuteReader, Raising SQL Injection Concerns
Batch Execution Behavior in SQLite .NET Wrapper and Security Implications Issue Overview: Execution of Multiple SQL Statements via IDbCommand::ExecuteReader in System.Data.SQLite.dll The core issue revolves around the behavior of the System.Data.SQLite.dll .NET wrapper when executing SQL commands that contain multiple statements separated by semicolons (e.g., SELECT * FROM Table1; DROP TABLE Table2;). Unlike the ODBC…