CVE-2021-45406

CVE-2021-45406 is a high-severity SQL injection vulnerability affecting SalonERP 3.0.1. An authenticated attacker can exploit this by injecting malicious SQL payloads into the 'sql' parameter when generating reports, allowing them to extract sensitive information like admin password hashes. With a CVSS score of 8.8, this vulnerability presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential impact remains significant.