Restaurant Management System EUVD-2026-90026

Requires only a network-reachable, running instance of AdithyaYelloju Restaurant-Management-System that exposes the User/ord.php Order Placement endpoint; no authentication, no user interaction, and no special configuration are needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is not a configuration prerequisite but deployment scarcity: this is an unversioned single-commit GitHub project with essentially no production installations. Any exposed instance running the vulnerable commit (7f0e7e8) is exploitable by default, and no vendor patch is available since the maintainer has not responded to the report.

This is a high-CVSS-looking but low-real-risk issue driven almost entirely by product obscurity rather than defect quality. The technical flaw is genuine and easy to trigger: CWE-89 SQL injection in the mysqli_query call in User/ord.php (Order Placement), reachable via the id/name arguments. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network, low-complexity, unauthenticated attack with no user interaction, and the vector carries E:P (proof-of-concept exploit maturity), consistent with the input signal that POC/exploit code is publicly available (via the GitHub issue). Exploitation status: publicly available exploit code exists - this is NOT the same as active exploitation; there is no CISA KEV listing and no EPSS score provided, so widespread or automated in-the-wild abuse is not evidenced. The vendor's own impact rating is deliberately conservative (VC:L/VI:L/VA:L), which understates typical SQLi consequences; a working injection into a query generally permits full read of the application database, so I assess confidentiality impact higher (C:H). The decisive limiting factor is prevalence: this is an individual developer's GitHub project ('AdithyaYelloju/Restaurant-Management-System') pinned to a single commit hash, with no release versioning and no vendor response to the issue report. Net priority is LOW for the general population (almost no production footprint) but the vulnerability itself would be trivially exploitable on any live instance that exists.

An unauthenticated remote attacker sends a crafted HTTP request to the Order Placement endpoint (User/ord.php), injecting SQL through the id or name parameter that flows unsanitized into a mysqli_query call. Using standard UNION-based or error-based injection, the attacker enumerates and dumps the backing MySQL database (user records, orders, credentials). Public proof-of-concept exploit detail has been disclosed in the project's GitHub issue tracker (issue #6), lowering the skill required to reproduce.