Restaurant Ims
Monthly
Unauthenticated SQL injection in the login handler of mansi-k Restaurant_IMS, a PHP-based restaurant information management system. The login_id and epsw parameters of lsmodal.php reach a database query without proper sanitisation, so a remote attacker who can reach the login modal can inject SQL before authenticating, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project is distributed as a rolling release at commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694, the vendor did not respond to the disclosure, no vendor patch is identified, and no public exploit code was identified at time of analysis; the practical exposure limit is that the codebase is a niche project with a small reachable population.
Unauthenticated SQL injection in the login handler of mansi-k Restaurant_IMS, a PHP-based restaurant information management system. The login_id and epsw parameters of lsmodal.php reach a database query without proper sanitisation, so a remote attacker who can reach the login modal can inject SQL before authenticating, with low confidentiality, integrity and availability impact per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The project is distributed as a rolling release at commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694, the vendor did not respond to the disclosure, no vendor patch is identified, and no public exploit code was identified at time of analysis; the practical exposure limit is that the codebase is a niche project with a small reachable population.