PT-2022-12412 · Martdevelopers · Iresturant

P0Cas · Published 2022-01-25 · Updated 2022-01-28 · CVE-2021-45802

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MartDevelopers iResturant version 1.0

Description The issue arises from the lack of verification of email and phone parameter values, which are directly added to the SQL query during membership registration, leading to SQL Injection.

Recommendations For MartDevelopers iResturant version 1.0, ensure that the email and phone parameter values are properly verified and sanitized before adding them to the SQL query to prevent SQL Injection. As a temporary workaround, consider implementing input validation for the email and phone parameters to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-45802

Affected Products

Iresturant

References · 5

• 🔥 https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#file-cve-2021-45802-md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45802 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45802 · Vendor Advisory
• https://t.me/cibsecurity/36208 · Telegram Post
• https://blog.pocas.kr/posts/sqli-iResturant · Note