Executive brief
A security vulnerability exists in the Restaurant Management System's password reset feature. This flaw allows an unauthorized person to manipulate database queries by entering specially crafted email addresses. If exploited, an attacker could gain unauthorized access to sensitive customer data or disrupt the system's operations.
Technical details
A SQL injection vulnerability exists in yashpokharna2555 restaurent-management-system due to the improper neutralization of special elements in the 'email' POST parameter within /forgotpassword.php. The application uses direct string concatenation to build SQL queries for both SELECT and UPDATE operations in the password reset flow, failing to use prepared statements or parameterized queries. A remote, unauthenticated attacker can exploit this by sending a crafted POST request to trigger boolean-based or time-based blind SQL injection. This allows for the extraction of data from the backend MySQL database and potentially broader system compromise, as similar patterns are reported in other authentication-related files like login_register.php and admin.php. No patch is currently available as the maintainer has not responded to the issue report.
Affected products
- yashpokharna2555 restaurent-management-system All versions (unversioned)
Timeline
- 2026-05-27: disclosed: Issue reported on GitHub repository
- 2026-06-28: advisory: CVE published by VulDB/NVD