Executive brief
A security vulnerability exists in the yashpokharna2555 Restaurant Management System, a web application used for managing restaurant operations. An attacker can register an account with a malicious username that, when viewed by other users or administrators, executes unauthorized scripts in their web browser. This could lead to unauthorized actions being performed on behalf of users, such as session hijacking or redirection to malicious websites.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Registration Handler component of the Restaurant Management System. The root cause is the failure to sanitize the 'Username' argument in 'login_register.php' before storing it in the database, and subsequently failing to apply output encoding (such as htmlspecialchars) when rendering the session username in 'index.php'. An attacker can register a new account with a JavaScript payload as the username. When any user (including the attacker) logs in and visits the index page, the payload is executed in the context of their browser session. This can be used to steal session cookies or perform unauthorized actions. As of the advisory date, the project has not responded to the issue report.
Affected products
- yashpokharna2555 restaurent-management-system rolling release
Timeline
- 2026-05-27: disclosed: Issue reported to the developer on GitHub
- 2026-06-28: advisory: CVE published and public exploit released