Restaurant Management System CVE-2026-109115

Requires that the vulnerable AdithyaYelloju Restaurant-Management-System application be deployed and network-reachable, with the password-reset flow (User/forgot3.php) exposed. Exploitation targets the email and password parameters of this pre-authentication Password Reset component, so NO valid account or prior authentication is needed (PR:N) and no user interaction is required. The primary limiting factor is deployment scope rather than configuration: because this is a continuously-rolling individual project with no released versions, there is no patched build to apply, and exposure depends entirely on an operator choosing to self-host this specific codebase.

Signals are mostly consistent in pointing to an easily reachable but low-impact flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, unauthenticated, low-complexity attack requiring no user interaction, which is credible for an SQL injection in a pre-authentication password-reset page (User/forgot3.php). However, the impact metrics are all Low (VC:L/VI:L/VA:L) and scope is unchanged, yielding a moderate 6.9 base score rather than a critical one - the vendor/VulDB assessment judged this a partial rather than full database compromise. Exploit maturity is E:P (Proof-of-Concept), matching the stated public exploit. No EPSS score, SSVC decision, or CISA KEV entry is present in the input, so there is no evidence of active or automatable exploitation - treat this as 'publicly available exploit code exists,' NOT in-the-wild. The practical risk is tempered by prevalence: this is an individual's GitHub project (AdithyaYelloju/Restaurant-Management-System), not enterprise software, so the real-world attack surface is minimal. Net: a genuine, trivially exploitable SQLi for anyone who deploys this specific project, but a very low organizational priority given near-zero production footprint and no exploitation telemetry.

A remote, unauthenticated attacker browses to the application's password-reset endpoint (User/forgot3.php) and submits a crafted value in the email or password parameter containing SQL metacharacters. Because input is concatenated into a database query, the attacker manipulates the query to read or alter data. A public proof-of-concept is referenced via the project's GitHub issue tracker, lowering the skill barrier.