The vulnerability resides in the admin/display_menu.php component of the Restaurant-Management-System, where the mysqli_query function is invoked with a user-controlled argument, s1. This oversight permits an attacker to inject arbitrary SQL statements, potentially exposing, modifying, or deleting database contents. The flaw exploits improper handling of user input (CWE‑74) and the use of unsanitized SQL commands (CWE‑89). The CVSS score of 5.3 indicates moderate severity for an attack that is externally reachable and could be used to compromise the application’s data layer.

The affected product is AdithyaYelloju Restaurant-Management-System. No specific version numbers are available because the project uses continuous delivery; all releases before the commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c are potentially vulnerable. There is no official patch or version update documented in the input, so any deployment of the current codebase may be exposed.

With a CVSS score of 5.3, the risk is moderate; however, the vulnerability is reachable from the internet and publicly exploit code exists. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Given the lack of an official fix, the likelihood of exploitation remains uncertain but non‑negligible. Administrators should assess whether the application’s database contains sensitive data and consider the potential impact of an unauthorized read, modification, or deletion.