CVE-2026-103232

AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection

View on CVE.org
Published Sep 30, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

The vulnerability is a SQL injection in the Admin/table_booking.php file of the Restaurant-Management-System. It arises because the Name parameter is passed directly to mysqli_query without validation. The flaw could allow an attacker to execute arbitrary SQL statements, and the CVE notes that remote exploitation is possible. The exploit has been publicly released.

Affected Systems

The affected product is AdithyaYelloju: Restaurant-Management-System, any installation that includes or predates the commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium-to-high risk. No EPSS data is available, and the vulnerability is not currently listed in CISA KEV. Based on the description, the likely attack vector is remote access to the admin/table_booking.php endpoint. The exploit has been made public, suggesting realistic threat of attack.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Use prepared statements or parameterized queries in admin/table_booking.php to prevent SQL injection.
  • Sanitize or validate the Name field to allow only safe characters before it is used in a query.
  • Restrict remote access to the admin interface via VPN or network segmentation and enforce strong authentication.

Generated by OpenCVE AI on September 30, 2026 at 18:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection
First Time appeared Adithyayelloju
Adithyayelloju restaurant-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*
Vendors & Products Adithyayelloju
Adithyayelloju restaurant-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 30, 2026, 5:04 PM
Reserved
Sep 30, 2026, 8:09 AM

View source JSON

Updated
Sep 30, 2026, 5:03 PM

JSON

Status
Deferred
Published
Sep 30, 2026, 5:16 PM
Modified
Sep 30, 2026, 6:18 PM

View source JSON

No data.

Updated
Sep 30, 2026, 7:30 PM

JSON