Description

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/add_menu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-20T18:16:54.583Z",
  "pubdate": "2026-09-20T18:16:54.583Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.\nThe vulnerability resides within the admin/add_menu.php script, allowing unvalidated user input to be processed directly by the database backend.\nSuccessful exploitation permits remote attackers to manipulate, bypass, or compromise the integrity and confidentiality of the application's database.\nThe vulnerability stems from improper neutralization of special elements used in SQL commands within the item, price, image, and type arguments.\nDue to the nature of the application as a rolling release, no official vendor-supplied security patches are currently available.\nThe risk implication is high, as the exploit is publicly disclosed, potentially allowing unauthorized actors to perform unauthorized database queries, data exfiltration, or modification of administrative data.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in admin/add_menu.php within the AdithyaYelloju Restaurant-Management-System.\nThe root cause is the failure of the application to implement parameterized queries or adequate input sanitization for user-supplied data transmitted via POST or GET requests to the identified file.\nSpecifically, the application accepts input through four distinct parameters: 'item', 'price', 'image', and 'type'. These parameters are concatenated directly into SQL query strings executed against the backend database without being sanitized or treated as data rather than executable code.\nAn attacker can exploit this by injecting crafted SQL payloads into any of the vulnerable parameters. Because the application does not validate or escape the input, the injected SQL statements are executed by the database engine with the privileges of the application's database user.\nThe attack flow proceeds as follows: 1) The attacker identifies the target endpoint, admin/add_menu.php. 2) The attacker crafts a malicious HTTP request containing SQL injection payloads within the 'item', 'price', 'image', or 'type' fields. 3) The backend script receives these fields and embeds them directly into an SQL statement, such as an INSERT or UPDATE query. 4) The database engine parses and executes the injected SQL command. 5) Depending on the injection type (e.g., error-based, union-based, or blind), the attacker may be able to exfiltrate data, bypass authentication mechanisms, or modify sensitive records.\nThis vulnerability is remotely exploitable, requiring no prior authentication unless the target endpoint is protected by an independent access control mechanism. The impact of successful exploitation is significant, potentially leading to unauthorized disclosure of sensitive information (e.g., administrator credentials, restaurant menu data, transaction records), modification or deletion of database contents, and potentially, depending on database configuration, administrative control over the database management system."
}