Restaurant Management System EUVD-2026-90076

Exploitation requires network reachability to the application's admin/table_booking.php endpoint and the ability to supply the 'Name' argument, which flows unsanitized into a mysqli_query() call (CWE-89). No authentication, privileges, or user interaction are required per the CVSS 4.0 vector (PR:N/UI:N/AT:N). The primary limiting factor is deployment scarcity: the affected code is an individual open-source PHP project pinned to a single unreleased commit (7f0e7e84...), with no packaged releases and an unresponsive maintainer, so few if any internet-facing production instances are expected. A running MySQL/MariaDB backend and web-accessible admin directory are implied prerequisites.

Multiple signals point to a genuinely exploitable but low-impact, low-reach issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - a classic SQL injection reachable over the network. However, impact is scored only VC:L/VI:L/VA:L (partial confidentiality/integrity/availability), yielding a moderate 6.9, and the E:P (Proof-of-Concept) exploit-maturity metric is consistent with the reported public PoC. CWE-89 and the 'Name' argument in admin/table_booking.php are consistent with the description. Key limiting factor: this is an obscure hobby/student GitHub project (AdithyaYelloju/Restaurant-Management-System) identified only by a commit hash with no released versions, no enterprise deployment, and an unresponsive maintainer - so real-world attack surface is minimal despite the network-unauthenticated vector. No EPSS score is provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; the public PoC indicates opportunistic-capable code exists but not confirmed in-the-wild use. Note the low VC/VI/VA rating may understate true impact: an unauthenticated SQLi typically enables full database read/modification, so the partial-impact scoring appears conservative - verify actual injectable query scope.

A remote, unauthenticated attacker submits a crafted value in the 'Name' parameter to admin/table_booking.php, which is concatenated into a mysqli_query() call without sanitization, allowing arbitrary SQL to execute against the backend MySQL database. A proof-of-concept is publicly available (linked from the project's GitHub issue #8), so exploitation requires no novel research - an attacker can extract or tamper with booking and account data. Because the flaw needs no authentication or user interaction, any reachable instance could be probed automatically.