The flaw is a classic SQL injection in the login function of Wecodex Restaurant CMS 1.0. Attackers can insert malicious SQL through the username field when submitting a POST request, causing the application to execute unintended queries. This enables unauthenticated users to read sensitive database contents using boolean‑based blind or time‑based techniques. The weakness aligns with CWE‑89 and can compromise confidentiality of stored data.

All installations of Wecodex Restaurant CMS version 1.0 that expose the login page to the public are vulnerable. No other product versions have been reported to be affected.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests exploitations are uncommon in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is sending crafted POST requests to the publicly exposed login endpoint; this inference is made because no other direct attack path is described in the data. An attacker who succeeds can read any data stored in the CMS database, potentially leading to privacy breaches and reputational damage.