CVE-2026-103232
Deferred Deferred - Pending Action

SQL Injection in Restaurant Management System

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulDB

Description
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103232
EUVD
EUVD-2026-90076

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adithyayelloju restaurant_management_system to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the Restaurant-Management-System. The flaw exists in the admin/table_booking.php file where the Name parameter is directly used in a SQL query without proper sanitization. Attackers can manipulate this parameter to inject malicious SQL commands, potentially accessing or modifying database contents.

Detection Guidance
  • Check for suspicious SQL queries in web server logs, particularly targeting admin/table_booking.php or User/table_booking.php with POST parameters containing SQL injection payloads like ' OR 1=1 --.
  • Use tools like sqlmap to test for SQL injection vulnerabilities by sending crafted requests to the vulnerable endpoints.
  • Monitor network traffic for unusual database queries or responses that indicate unauthorized data access or manipulation.
  • Inspect HTTP POST requests to the table_booking.php endpoints for unsanitized 'name' parameters that may contain SQL injection attempts.
Impact Analysis

An attacker could exploit this to extract sensitive data like admin credentials or user records, including plaintext passwords. They might also perform remote code execution or launch XSS attacks by injecting malicious scripts. Unauthenticated visitors can exploit this through the search box.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies
  • Apply input validation and sanitization to the 'name' POST parameter in table_booking.php to prevent SQL injection.
  • Use prepared statements with parameterized queries instead of direct string interpolation in SQL queries.
  • Implement proper session checks to ensure only authenticated users can access sensitive endpoints.
  • Update the application to the latest version if a patch is released by the project maintainers.
  • Consider temporarily disabling the table booking feature until the vulnerability is addressed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart