In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2022-01-14T19:25:16
Updated: 2024-08-04T04:39:20.655Z
Reserved: 2021-12-20T00:00:00
Link: CVE-2021-45406
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-01-14T20:15:14.937
Modified: 2024-11-21T06:32:10.107
Link: CVE-2021-45406
Redhat
No data.