Description
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-30
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL injection
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is a SQL injection in the Admin/table_booking.php file of the Restaurant-Management-System. It arises because the Name parameter is passed directly to mysqli_query without validation. The flaw could allow an attacker to execute arbitrary SQL statements, and the CVE notes that remote exploitation is possible. The exploit has been publicly released.

Affected Systems

The affected product is AdithyaYelloju: Restaurant-Management-System, any installation that includes or predates the commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium-to-high risk. No EPSS data is available, and the vulnerability is not currently listed in CISA KEV. Based on the description, the likely attack vector is remote access to the admin/table_booking.php endpoint. The exploit has been made public, suggesting realistic threat of attack.

Generated by OpenCVE AI on September 30, 2026 at 18:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Use prepared statements or parameterized queries in admin/table_booking.php to prevent SQL injection.
  • Sanitize or validate the Name field to allow only safe characters before it is used in a query.
  • Restrict remote access to the admin interface via VPN or network segmentation and enforce strong authentication.

Generated by OpenCVE AI on September 30, 2026 at 18:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection
First Time appeared Adithyayelloju
Adithyayelloju restaurant-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*
Vendors & Products Adithyayelloju
Adithyayelloju restaurant-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Adithyayelloju Restaurant-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-30T17:04:12.956Z

Reserved: 2026-09-30T08:09:20.521Z

Link: CVE-2026-103232

cve-icon Vulnrichment

Updated: 2026-09-30T17:03:44.482Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T17:16:42.000

Modified: 2026-09-30T18:18:15.767

Link: CVE-2026-103232

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T19:30:18Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')