Restaurant Management System EUVD-2026-89996

Exploitation requires network reachability to the application's admin/delete1.php endpoint, which the CVSS vector treats as unauthenticated (PR:N) despite its location under the admin/ directory - the description labels it an 'Unauthenticated Action Script'. The attacker only needs to supply a manipulated ID request parameter; no user interaction, no special privileges, and no non-default configuration are required. Practical limiting factors are the product's rarity (very few live deployments) and the need for the vulnerable delete1.php endpoint to be internet-exposed. No patched release exists (rolling-release project, vendor unresponsive), so any running instance is affected.

Signals point to a genuine but low-footprint issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity SQL injection - the easiest possible exploitation profile - and the E:P (Proof-of-Concept) exploit maturity is corroborated by a publicly posted GitHub issue, so publicly available exploit code exists. However, this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score provided, so widespread or automated in-the-wild abuse is not evidenced. The vendor-assigned score of 6.9 rests on VC:L/VI:L/VA:L (all low impacts), which likely understates a classic mysqli_query injection that typically permits full database read; the true confidentiality impact is probably higher than the vendor rating. The dominant risk-limiting factor is prevalence, not exploitability: this is an obscure open-source hobby project, so despite an easy unauthenticated exploit, real-world exposure is small. Net assessment: technically easy and exploit-public, but low operational priority for most defenders due to negligible deployment footprint. Note the component label 'Unauthenticated Action Script' plus the admin/ path is slightly contradictory - the file lives under admin/ yet is described as unauthenticated; the CVSS PR:N supports unauthenticated reachability, but verify the auth boundary against the source if this product is in use.

A remote unauthenticated attacker sends a crafted HTTP request to admin/delete1.php with a malicious ID parameter (e.g., a UNION-based or boolean/time-based payload) that is concatenated into a mysqli_query call. This lets them read or manipulate the backend MySQL database without credentials. A public proof-of-concept is already available via the project's GitHub issue tracker (issue #5), lowering the skill barrier.