CVE-2026-95868
Received Received - Intake

SQL Injection in Restaurant Management System

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqli_query of the file admin/display_menu.php of the component Search Form. This manipulation of the argument s1 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-95868
EUVD
EUVD-2026-84989

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adithyayelloju restaurant_management_system to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the Restaurant-Management-System. It affects the mysqli_query function in admin/display_menu.php where the s1 parameter is directly used in SQL queries without sanitization. Attackers can inject malicious SQL code via the search form to manipulate database queries.

Detection Guidance

To detect this SQL injection vulnerability, inspect the admin/display_menu.php and admin/tables.php files for unsanitized POST parameter s1 usage in SQL queries. Check for direct interpolation of user input into LIKE clauses without validation. Test by sending crafted POST requests with SQL payloads like ' OR 1=1 -- to observe abnormal database responses.

Impact Analysis

An attacker could exploit this to extract sensitive data like usernames, passwords, or database structure. They might also perform unauthorized actions such as modifying or deleting data. The vulnerability allows remote attacks and is accessible to authenticated users, including regular users.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately sanitize all user inputs, especially the s1 parameter, using prepared statements or input validation. Restrict database user permissions to limit damage. Disable error-based SQL injection techniques by hiding database errors. Monitor for unusual queries or data exfiltration attempts in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-95868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart