Executive brief
The Restaurant Management System is a web-based application for managing restaurant operations including orders and menus. The system is vulnerable to SQL injection in search forms accessible to authenticated users, allowing attackers to extract sensitive data from the database including credentials, orders, and user information. Exploits are publicly available and could be used to compromise the restaurant's operational data and customer information.
Technical details
SQL injection exists in the mysqli_query function within admin/display_menu.php and admin/tables.php where the POST parameter s1 is directly interpolated into a LIKE clause without sanitization. An authenticated attacker can use UNION-based payloads to exfiltrate arbitrary database contents that are reflected in the response HTML. The vulnerability requires authentication but affects both admin and regular users; combined with other techniques (stacked queries, INTO OUTFILE) it could enable remote code execution.
Affected products
- Restaurant-Management-System
Timeline
- 2026-08-26: disclosed: Issue reported on GitHub
- 2026-09-23: advisory: CVE-2026-95868 published