A vulnerability was found in the Order Management module of a PHP‑based restaurant management system. The function that executes SQL statements is called with an order identifier that can be altered by an attacker. Changing this identifier lets a user retrieve or modify orders that they are not permitted to view, effectively bypassing the application’s authorization controls. The flaw can be exploited remotely through the public web interface and has been disclosed for public use. It represents a moderate security risk, scoring 6.9 on the CVSS scale, and exposes the system to unauthorized data access.

The affected product is the Open‑Source Restaurant‑Management‑System released by AdithyaYelloju. No official versioning is employed by the project, so any deployment that contains the code up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c is potentially vulnerable. The repository does not indicate a separate fix release, so the entire code base until that point should be treated as impacted.

With a CVSS score of 6.9, the vulnerability is considered moderate, but its exploitation is possible from outside the network because the attack vector is remote. The EPSS score is not available and the flaw has not been listed in the CISA KEV catalog, suggesting less industry attention yet the public disclosure means attackers could still target the system. An attacker only needs to know or guess an order ID and send a crafted request; no additional privileges or local access are required. No patch is currently published, so the risk persists until the code is updated or removed.