Restaurant Management System EUVD-2026-90074

A running instance of AdithyaYelloju Restaurant-Management-System (commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c or earlier) must be network-reachable, with the Order Cancellation feature (User/cancel.php) accessible. Exploitation requires no authentication, no user interaction, and no special configuration - only the ability to supply the 'ID' parameter to cancel.php. The primary limiting factor is deployment scarcity: this is an unmaintained single-developer project with no packaged releases, so exposed live instances are expected to be very few.

Signals are mixed but consistent with a low-priority, low-impact issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction - genuinely easy to trigger - but impact is capped at VC:L/VI:L/VA:L (partial confidentiality/integrity/availability), yielding a modest 5.5 score despite the trivial attack path. A publicly available exploit exists and the E:P (Proof-of-Concept) temporal metric confirms PoC-level maturity, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. This is classic SQLi in a hobby/student PHP project rather than an enterprise product, so real-world risk is driven almost entirely by prevalence, which is negligible. The low VC/VI/VA rating is somewhat conservative for SQL injection (union/blind SQLi can often fully dump a database), so the true confidentiality impact may exceed the vendor's L rating - but the scoring is the vendor/VulDB assessment and cannot be independently confirmed. Net: a real, publicly-exploitable flaw, but not a broad-fleet priority.

A remote, unauthenticated attacker sends a crafted value in the 'ID' parameter to User/cancel.php, which is concatenated unsanitized into a mysqli_query call, injecting arbitrary SQL against the order-cancellation flow. Because a public proof-of-concept exists (referenced in the project's GitHub issue #7) and no authentication or user interaction is required, an attacker can automate extraction of database contents or manipulation of order records. Exploitation is low-complexity but limited to deployments of this specific open-source application.