Restaurant_IMS EUVD-2026-109328

The attacker only needs network reachability to the Restaurant_IMS login modal (lsmodal.php); because the injection is in the login_id/epsw parameters processed during authentication, exploitation occurs pre-authentication against a default deployment (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is not configuration or privileges but exposure: the application instance must be internet- or network-accessible to the attacker, and the affected codebase is a niche project with very limited deployment, so the population of reachable targets is small. The specific SQL trigger/payload is not detailed in the available sources beyond the named parameters.

This is a pre-authentication SQL injection (CWE-89) in the mansi-k Restaurant_IMS login handler (lsmodal.php), where the login_id/epsw parameters reach a database query. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which on its own argues for easy exploitation; however, the vendor-assigned impact is deliberately modest (VC:L/VI:L/VA:L, no scope change), yielding a medium base score of 6.9. The decision framework ranks this 'this_month' (VulDB-reported) rather than act_now or emergency. It is NOT in CISA KEV and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation; the only references are VulDB catalog/CTI/submission pages, which do not confirm working exploit code. The real-world priority is tempered less by the technical ease of exploitation than by the product's footprint: this is an obscure open-source/hobby project with no meaningful enterprise deployment, so for most organizations this is a low-priority, high-ease-but-low-reach issue rather than a fleet-wide emergency. Note also that the vendor was contacted and did not respond, and the rolling-release model means no fixed version is published - verify directly against the current repository state.

A remote, unauthenticated attacker reaches the Restaurant_IMS login modal (lsmodal.php) and submits crafted values in the login_id or epsw fields that break out of the SQL query assembled before mysqli_connect-based authentication. No public working exploit is confirmed in the input (only VulDB reference pages exist), but because the flaw sits on the unauthenticated login path with low attack complexity, the trigger surface is directly exposed to anyone who can reach the application.