A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. (CVE-2026-115999)
Source GCVE Database
Not known to be exploited · CVSS 7.3 Medium.
Data as of 10/25/2026, 07:50:58 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LWhat to do
AI-suggested
In the meantime, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login_id and epsw parameters.
Description
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or denial of service. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, no known exploits in the wild have been reported.
Summary
This vulnerability (CVE-2026-115999) affects the mansi-k Restaurant_IMS software, specifically the mysqli_connect function in lsmodal.php. An attacker can manipulate the login_id and epsw parameters to perform SQL injection attacks remotely. Due to the rolling release approach of the product, no explicit version information is available for affected or patched releases. The vendor was contacted but did not provide any response or patch information. The CVSS 3.1 score is 7.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.
Weaknesses
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.