The vulnerability occurs in the delete1.php script of AdithyaYelloju Restaurant-Management-System. A parameter named ID is passed to mysqli_query without proper sanitization, enabling an attacker to inject arbitrary SQL. This flaw allows remote attackers to alter, delete or view database contents. The weakness is a classic SQL injection (CWE-89) compounded by an unauthenticated action script (CWE-74). It can be exploited by sending crafted requests to delete1.php and manipulating the ID parameter, potentially leading to data loss or unauthorized data access.

AdithyaYelloju's Restaurant-Management-System, all releases prior to the commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. No specific version numbers are published, but the flaw exists in any deployment of the repository's delete1.php script that has not been patched.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so risk cannot be quantified precisely, and the flaw has not been listed in the CISA KEV catalog. The exploit is publicly available and can be performed remotely through a crafted HTTP request to the delete1.php endpoint. Since the action script is unauthenticated, an attacker does not need credentials to trigger the injection, making the risk higher in environments where the script is exposed to the internet. The lack of patching information adds uncertainty, but the system remains vulnerable until mitigation.