CVE-2026-103229: AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need an account or user interaction to exploit this issue?
No. The vulnerability is remotely exploitable without authentication or user interaction by manipulating the ID argument.
Is exploitation likely to be practical?
Yes. The attack complexity is rated low, and a public exploit is available.
Can affected deployments be identified by a product release version?
No. The product uses rolling releases, and no affected or fixed release-version details are available. The issue is reported to affect code up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.
Is a vendor fix available?
No updated release information is available. The project was notified through an issue report but had not responded at the time of the report.