CVE-2026-115999: mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection
A vulnerability has been found in mansi-k RestaurantIMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqliconnect of the file lsmodal.php. The manipulation of the argument loginid/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable and requires no privileges or user interaction. An attacker can manipulate the login_id or epsw argument handled by lsmodal.php to attempt SQL injection.
Which deployments should be considered potentially affected?
Deployments of mansi-k Restaurant_IMS containing the affected lsmodal.php code should be considered potentially affected. The available information does not provide fixed or affected release versions because the product uses a rolling release model.
What should teams do if an update is not available?
Restrict remote access to the affected application where possible and limit access to lsmodal.php to trusted users or networks. Monitor requests involving login_id and epsw for SQL injection payloads or unexpected database errors.
How can defenders look for attempted exploitation?
Review web-server and application logs for requests to lsmodal.php containing suspicious login_id or epsw values, particularly SQL syntax, comments, quote characters, or boolean-style conditions. Also investigate unexpected database errors associated with that endpoint.