A flaw in the admin/add_table.php script lets an attacker manipulate the table/members/price input to inject arbitrary SQL commands through the mysqli_query function. This classic injection can read, modify, or delete database rows, compromising confidentiality and integrity of the restaurant management data. The issue is a standard SQL injection weakness (CWE-74 and CWE-89).

The vulnerability exists in the AdithyaYelloju Restaurant Management System, affecting the administrative add_table.php module. Because the project publishes continuous rolling releases, specific affected version numbers are not listed, and the last known vulnerable commit is identified as 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

The CVSS score of 5.3 indicates a moderate severity, but a known public exploit demonstrates that it can be launched remotely against any exposed instance. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, so immediate exploitation risk depends largely on network exposure and whether server-side input sanitization remains lax. Attackers could exploit the weakness without authentication if the add_table.php endpoint is publicly reachable, leading to potential data leakage, tampering, or deletion.