Restaurant Management System CVE-2026-94042

Requires an authenticated session with access to the admin interface (admin/add_table.php) of AdithyaYelloju Restaurant Management System; the attacker must be able to submit the table, members, or price parameter to that endpoint. Exploitation is limited by the authentication requirement (PR:L, admin-area path) and by the product's rarity; no user interaction or special non-default configuration is needed once authenticated. Because the project ships as a rolling release with no versioned patch and is unresponsive, no fixed build is available to remediate against.

This is a genuine but low-priority SQL injection. The vendor CVSS 4.0 score of 5.3 (medium) is consistent with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L: network-reachable and low-complexity, but requiring authentication (PR:L) and - per the vendor - only partial confidentiality/integrity/availability impact. The E:P (Proof-of-Concept) exploit-maturity metric aligns with the confirmed public POC in the project's own GitHub issue tracker (issue #3). No EPSS score and no CISA KEV listing are present in the input, so there is no evidence of active or widespread exploitation - the signal is 'publicly available exploit code exists,' which is distinct from in-the-wild use. I dispute the vendor's VC:L: a mysqli_query SQL injection reachable via three separate parameters typically permits UNION/blind extraction of the entire backing database, which is a high confidentiality impact (VC:H), so real conf-impact is likely understated. The strongest mitigating factor is that add_table.php resides under /admin/, implying the endpoint is reachable only by an authenticated admin-area user (PR:L), which sharply narrows the threat population. Net: a real, verifiable flaw but limited real-world urgency given authentication requirement, obscure product, and no exploitation evidence.

An authenticated user with access to the restaurant admin panel submits a crafted value in the table, members, or price parameter to admin/add_table.php, where it is concatenated unsanitized into a mysqli_query call. Using UNION-based or blind injection the attacker dumps credentials and other data from the database, and could escalate to authentication bypass or data tampering. A public proof-of-concept exists in the project's GitHub issue #3, lowering the skill required.