CVE-2026-109116: AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqliquery of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. An attacker manipulates an ID argument in the Order Management component to bypass authorization.
Are publicly known exploits available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Which releases are affected?
The project does not use versioning, so affected and unaffected releases cannot be determined from release information. The issue was identified in code up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.
Is a vendor fix available?
No response has been reported from the project after it was notified through an issue report. The available information does not identify a patch or fixed release.