Executive brief
The Restaurant Management System, used to manage restaurant tables and bookings, contains an SQL injection flaw in its table management interface. An authenticated attacker can inject malicious SQL commands through the table, members, and price parameters to insert arbitrary rows into the database, disrupt booking operations, or escalate privileges to execute remote code on the server.
Technical details
The vulnerability exists in admin/add_table.php where user-supplied POST parameters (table, members, price) are directly interpolated into an SQL INSERT statement without escaping or prepared statements. An authenticated attacker can close the VALUES clause and inject additional rows or commands. The attack requires valid user authentication (any registered user, not just admin due to a separate auth bypass) and network access to the web interface; no user interaction beyond crafted requests is needed.
Affected products
- AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c
Timeline
- 2026-08-26: disclosed: Vulnerability reported via GitHub issue
- 2026-09-20: advisory: CVE-2026-94042 published