← Database

CVE-2021-45406

HIGH CVSS: 8.8 Published: 2022-01-14 Modified: 2026-06-17

Description

In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a report. Upon successfully discovering the login admin password hash, it can be decrypted to obtain the plain-text password.

Affected Platforms

Salonerp Project Salonerp

Weakness Type

CWE-89

References