The vulnerability is triggered when input from the id or name parameters in the User/ord.php file is concatenated directly into a SQL query using mysqli_query. This omission of input validation and lack of parameterized queries permits the injection of arbitrary SQL statements, enabling an attacker to read, modify, or delete data in the database. The weakness maps to CWE-74 and CWE-89, giving the attacker control over the database and violating confidentiality, integrity, and potentially availability.

Vulnerable code exists in the AdithyaYelloju Restaurant‑Management‑System repository up to the hash 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. No official patch or fix has been released by the project maintainers as of the latest update, and the issue remains open.

The CVSS score of 6.9 indicates a moderate to high severity, and the exploit can be launched remotely. No EPSS score is available, but the public disclosure and remote nature of the attack suggest a non‑negligible likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the lack of vendor response increases the risk to users who rely on the default configuration.