After encrypting a message with pycryptodome as AES, it stores that key in a file. However, the contents of that file have not yet been successfully stored in MySQL database in its 100% original form. This makes decrypting the text nearly impossible.

• One possibility is storing the whole file in the database, not just the text that is inside.

Not fully vulnerable; If the credentials do not match, it only returns the print statement "Failure". However, if it says something like print("Wrong password for ", myresult) for line 167 in main.py, then we have a big problem; it will return the account id, username, and hashed password, along with the salt.

How to replicate this (if the else statement returns something other than "Failure"):

• run main.py
• Replicate:
  
  + hashed password & salt (both not included for security purposes)

Again, this is not a real threat, however, random apostrophes crash the program.

Video on how to prevent SQL injection here: https://youtu.be/pd-0G0MigUA?t=898

Credit to: Corey Schafer