CVE-2021-45406

In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report

published January 14, 2022

CVSS
—
EPSS
2%
Percentile
78.0
In the wild
Unconfirmed
What it is

In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01775 · 78.0th percentile
Published
2022-01-14T19:25Z
EPSS history
Timeline
  • 14 JAN 19:25Z
    In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report
    cvelistv5