CVE-2023-29849

HIGH

Bang Resto 1.0 - SQL Injection via btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-29849. PoCs published by Rahad Chowdhury.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Bang Resto v1.0 via the 'btnMenuItemID' parameter. It provides a step-by-step guide to exploit the vulnerability using a UNION-based SQL injection to extract user, database, and version information.

Description

Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Rahad Chowdhury · textwebappsphp
https://www.exploit-db.com/exploits/51378

This exploit demonstrates a SQL injection vulnerability in Bang Resto v1.0 via the 'btnMenuItemID' parameter. It provides a step-by-step guide to exploit the vulnerability using a UNION-based SQL injection to extract user, database, and version information.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Bang Resto v1.0
Auth required
Prerequisites: Access to staff panel · Intercepting proxy like Burp Suite
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0316
EPSS Percentile 86.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
hockeycomputindo/bang_resto 1.0
Published Apr 24, 2023
Tracked Since Feb 18, 2026