# Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection# Date: 2023-04-02# Exploit Author: Rahad Chowdhury# Vendor Homepage:https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html# Software Link:https://github.com/mesinkasir/bangresto/archive/refs/heads/main.zip# Version: 1.0# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53# CVE: CVE-2023-29849*Affected Parameters:*btnMenuItemID, itemID, itemPrice, menuID, staffID, itemPrice, itemID[],itemqty[], btnMenuItemID*Steps to Reproduce:*1. First login your staff panel.2. then go to "order" menu and Select menu