Executive brief
The Restaurant Management System is a web application that manages restaurant operations, including menu items and orders. An authenticated user can inject malicious SQL code through the admin menu addition form, allowing them to insert unauthorized menu items, modify the database, or potentially execute arbitrary code on the server.
Technical details
The admin/add_menu.php file concatenates user-supplied POST parameters (item, price, image, type) directly into an SQL INSERT statement without escaping or parameterization. An authenticated attacker can close the VALUES clause and inject additional SQL statements, including arbitrary INSERTs or, if stacked queries are enabled, schema modifications or file writes. The vulnerability requires authentication but affects any logged-in user, including ordinary registered users not just administrators.
Affected products
- AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c
Timeline
- 2026-08-26: disclosed: Issue reported on GitHub
- 2026-09-20: advisory: CVE-2026-94041 published