A flaw in the AJAX endpoint /admin/ajax_files of the jairiidriss restaurant-website-php-mysql application allows an attacker to invoke the endpoint’s functionality without any authentication. The vulnerability is caused by missing access control and lack of authentication checks, which can enable an attacker to perform operations normally restricted to authenticated users or administrators. The weakness is identified by CWE-287 and CWE-306.

Any deployment of jairiidriss restaurant-website-php-mysql that has not yet incorporated an update beyond commit 521428b5b612449df0cf4a5d15ee40cba67f3d is vulnerable. Therefore, version details for affected or updated releases cannot be definitively enumerated beyond the stated commit. Administrators should verify whether the copy of the application in use contains this commit or later code. The vendor has been notified of the issue but has not yet released a patch.

The CVSS score of 6.9 reflects moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the description states that the exploit can be carried out remotely and that an attacker has publicly disclosed it. A potential attacker could send crafted HTTP requests to /admin/ajax_files from anywhere on the internet to bypass authentication and manipulate data processed by the endpoint.