Should work

1 files changed, 2 insertions, 1 deletions

diff --git a/superadmin/index.js b/superadmin/index.js
index d80ac17..2518f97 100644
--- a/superadmin/index.js
+++ b/superadmin/index.js
@@ -9,7 +9,8 @@ app.use("/", checkSuperAdmin, express.static(__dirname + "/public"))
 app.post("/api/query", checkSuperAdmin, async (req, res) => {
     const { query } = req.body;
     let s;
-    if (!query || !query.toLowerCase().startsWith("select") || (s = query.split(";")).length > 1 && s[1] !== "")
+    const lc = query.toLowerCase();
+    if (!query || !(lc.startsWith("select") || lc.startsWith("delete from") || lc.startsWith("update") || lc.startsWith("insert into")) || (s = query.split(";")).length > 1 && s[1] !== "")
         return res.status(403).json({ success: false });
     try {
         const response = await db.query(query);