CVE-2021-45802

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone parameter values are added to the SQL query without any verification at the time of membership registration.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.pocas.kr/posts/sqli-iResturant/Broken Link
https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#file-cve-2021-45802-mdExploit, Third Party Advisory
https://blog.pocas.kr/posts/sqli-iResturant/Broken Link
https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#file-cve-2021-45802-mdExploit, Third Party Advisory

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-458038.8MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is added to the SQL que CVE-2021-458068.8jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.CVE-2021-458079.8jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.CVE-2021-458088.8jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server.CVE-2021-458099.8GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The w CVE-2021-458107.5GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI. The w CVE-2021-458116.5A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execu CVE-2021-458126.1NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's sessio CVE-2021-458136.1SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting ma CVE-2021-458149.8Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrati CVE-2021-458156.1Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-458186.1SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting.