CVE-2026-109115
Received Received - Intake

SQL Injection in Restaurant Management System via Password Reset

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109115
EUVD
EUVD-2026-98350

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the Restaurant-Management-System affecting the User/forgot3.php file. It allows attackers to manipulate the email/password parameters during password reset, enabling them to inject malicious SQL commands. The system lacks proper security controls in the password reset process, allowing unauthenticated users to reset any account's password and gain full access.

Detection Guidance

Check for unauthorized password reset requests in web server logs targeting User/forgot3.php. Look for POST requests with email/password parameters without session tokens or authentication headers. Test by sending a POST request to User/forgot3.php with arbitrary email/password values to see if the system updates passwords without validation.

Impact Analysis

An attacker could exploit this to reset passwords for any user, including administrators, and take over their accounts. Since passwords are stored in plaintext, the attacker gains immediate access to sensitive data and system controls. This could lead to data theft, unauthorized transactions, or complete system compromise.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. GDPR mandates strict authentication and data security measures, while HIPAA requires safeguards to prevent unauthorized access to sensitive health data. The flaw exposes systems to breaches, risking non-compliance and severe penalties.

Mitigation Strategies

Disable the User/forgot3.php endpoint if possible. Implement server-side validation to ensure password reset requests are authenticated and verified. Require email confirmation before updating passwords. Hash passwords instead of storing them in plaintext. Monitor for suspicious activity in the password reset process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart