CVE-2023-29849

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/171900/Bang-Resto-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/mesinkasir/bangresto/issues/3Broken Link
http://packetstormsecurity.com/files/171900/Bang-Resto-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/mesinkasir/bangresto/issues/3Broken Link

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29855.5A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause CVE-2023-298507.5SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain infor CVE-2023-298546.1DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.CVE-2023-298557.2WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php.CVE-2023-298569.8D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary.CVE-2023-298575.3An issue in Teslamate v1.27.1 allows attackers to obtain sensitive information via directly accessing the teslamate link.CVE-2023-29869.8The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2 CVE-2023-298607.5An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via CVE-2023-298619.8An issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the managemen CVE-2023-298629.8An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel CVE-2023-298639.8Medical Systems Co. Medisys Weblab Products v19.4.03 was discovered to contain a SQL injection vulnerability via the tem:statement parameter CVE-2023-298676.5Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts