A security flaw in itsourcecode Cafe Reservation System 1.0 allows an attacker to inject arbitrary SQL code into the database by manipulating the Username field in the /curvus2/signup.php page of the Registration component. Because the input is not properly sanitized, an attacker can read, modify, or delete database records, potentially exposing sensitive reservation data and user credentials. The weakness is classified as CWE‑74 and CWE‑89.

The vulnerability affects the Cafe Reservation System version 1.0 published by itsourcecode. The affected product is identified by the CPE cpe:2.3:a:luffypirates:cafe_reservation_system:1.0 and includes the Registration component's signup.php script.

An attacker can exploit the flaw remotely by sending a crafted HTTP request to /curvus2/signup.php containing an injected Username value. The CVSS score of 6.9 indicates medium severity with potential for data compromise. Although the EPSS score is below 1%, the public release of an exploit increases the likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but due to its remote SQL injection nature it remains a significant concern.