EUVD-2026-41661
GHSA-pqx4-w6cx-6h2x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no complexity; limited confidentiality, integrity, and availability impact scoped to the application's own data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Unauthenticated access to the administrative AJAX endpoint in jairiidriss/restaurant-website-php-mysql exposes backend admin functions to any remote attacker without credentials. The /admin/ajax_files endpoint fails to enforce authentication (CWE-306), allowing manipulation of whatever administrative operations it services - likely CRUD operations on menu items, orders, or reservations. No CISA KEV listing exists, but a public proof-of-concept was published via GitHub issue #6, and the maintainer has not responded to disclosure, leaving all deployments up to commit 521428b5b612449df0cf4a5d15ee40cba67f3d35 unpatched.
Technical ContextAI
The affected product is a PHP/MySQL restaurant website application hosted on GitHub under jairiidriss/restaurant-website-php-mysql, identified by CPE cpe:2.3:a:jairiidriss:restaurant-website-php-mysql:*:*:*:*:*:*:*:*. The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function), meaning the /admin/ajax_files endpoint - which handles asynchronous backend requests - processes incoming HTTP requests without verifying that the caller holds a valid authenticated session or administrative role. In PHP applications of this pattern, AJAX endpoints in the admin path typically service privileged operations such as record creation, modification, or deletion against the MySQL backend, making the missing authentication gate a meaningful exposure of data integrity and confidentiality.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer was notified via issue report but has not responded. Any deployment of this codebase should immediately restrict access to the /admin/ajax_files path using web server-level authentication controls: in Apache, add an .htaccess Require valid-user directive protecting the /admin/ directory tree; in nginx, add an auth_basic block to the relevant location. As a network-level compensating control, place the admin interface behind a VPN or IP allowlist to prevent public internet access entirely - note this does not fix the underlying code flaw but eliminates remote exploitation. If the application must remain publicly accessible, manually implement a PHP session authentication check at the top of ajax_files before any function dispatch. The GitHub issue documenting the POC is at https://github.com/jairiidriss/restaurant-website-php-mysql/issues/6 and the VulDB entry is at https://vuldb.com/vuln/376138.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today