Description

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/add_table.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-20T18:16:54.763Z",
  "pubdate": "2026-09-20T18:16:54.763Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the AdithyaYelloju Restaurant Management System, affecting all versions up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.\nThe vulnerability resides within the admin/add_table.php script, specifically concerning the improper handling of user-supplied input to the mysqli_query function.\nThe flaw allows remote, unauthenticated attackers to manipulate database queries by injecting arbitrary SQL commands via the 'table', 'members', or 'price' parameters.\nSuccessful exploitation could lead to unauthorized data exposure, modification, or deletion of sensitive administrative records.\nGiven the public availability of an exploit, the risk of exploitation is high. The vendor has been notified but has not yet provided a patch or remediation for this security defect.",
  "technicalDetails": "The vulnerability is caused by improper neutralization of special elements used in SQL commands within the admin/add_table.php file. Specifically, the application utilizes the mysqli_query function to execute database queries constructed with direct input from the 'table', 'members', and 'price' parameters without employing prepared statements or parameterized queries.\nThe root cause is a failure to sanitize input fields, which allows an attacker to break out of the intended SQL statement structure. By providing crafted input containing SQL syntax (such as single quotes, comment delimiters, or UNION operators), an attacker can alter the query's logic. This behavior facilitates the execution of arbitrary SQL commands against the backend database management system.\nThe attack flow proceeds as follows: An attacker sends a malicious HTTP request to the vulnerable endpoint (admin/add_table.php). The application receives the parameters and concatenates them directly into the SQL query string. The database server then interprets the injected malicious characters as executable code rather than literal data. Consequently, the database processes the manipulated query, which may result in information schema discovery, authentication bypass, or full database compromise depending on the database user's privileges.\nThe flaw is accessible remotely over the network, requiring no specific authentication or elevated privileges to trigger, depending on the specific implementation of the endpoint. Because the application utilizes a rolling release model, versioning is ambiguous, but all deployments up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c are confirmed susceptible.\nPost-exploitation impact includes full unauthorized access to the application's underlying database. An attacker could exfiltrate administrative credentials, modify table configurations, or drop database objects, leading to total loss of integrity and availability of the system. The absence of vendor-supplied patches necessitates immediate manual intervention by system administrators."
}