An unauthenticated attacker can inject arbitrary SQL into the keysearch parameter of the vRestaurant 1.9.4 component’s menu-listing-layout endpoint, allowing execution of SELECT statements that can enumerate tables and retrieve sensitive data. The flaw is a classic SQL injection, described by CWE‑89, and does not provide remote code execution but enables an attacker to compromise the confidentiality of the database content.

The Joomla component vRestaurant from Wdmtech, version 1.9.4, is vulnerable. Only installations of this exact version are affected; the component can be found in the Joomla Extension Directory under the vertical market package.

The CVSS score of 8.8 indicates high severity and the EPSS score is not available, but the lack of a KEV listing does not lower the risk; the vulnerability can be exploited remotely via crafted HTTP POST requests with no authentication needed. Attackers with network visibility to the site can send the payload directly to the exposed endpoint, making exploitation straightforward for motivated actors.