Technical impact
A vulnerability exists in the Restaurant_IMS system where the mysqli_connect function in lsmodal.php can be manipulated through the login_id and epsw arguments to inject arbitrary SQL. The flaw is characterized by CWE-74 and CWE-89 and allows an attacker to alter or bypass database queries, potentially reading, modifying, or deleting sensitive data. Remote exploitation is possible through the web interface, giving a remote attacker full power over the connected database without authentication.
Affected Systems
The flaw affects the mansi-k Restaurant_IMS application, specifically the lsmodal.php component that relies on mysqli_connect for database connectivity. Because the product follows a rolling release model, a precise version range is not available; any active deployment that includes the identified code path is vulnerable.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate severity. No EPSS value is published, and the vulnerability is not listed in CISA’s KEV catalog, but remote exploitation remains feasible through crafted web requests. An attacker could construct input that escapes the intended query structure and execute arbitrary SQL, potentially compromising confidentiality, integrity, or availability of the underlying data. The lack of a vendor response or patch increases the risk to ongoing deployments.
