SQL Injection Vulnerability in SalonERP 3.0.1 Allows Unauthorized Access and Password Decryption

CVE-2021-45406 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.