CVE-2026-103231: SQL Injection in AdithyaYelloju Restaurant-Management-System
CVE-2026-103231 is a SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System affecting the Order Cancellation component. The flaw exists in the mysqli_query function within User/cancel.php, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
AI Analysis
Technical Summary
This vulnerability in AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c allows remote attackers to perform SQL injection via the ID parameter in the User/cancel.php file's mysqli_query function. The issue was reported early to the project, but no vendor response or patch has been provided. Exploit code is publicly available, increasing the risk of exploitation.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database through the Order Cancellation feature. This can lead to unauthorized data access, modification, or deletion. The vulnerability requires no privileges or user interaction but has limited scope and impact as indicated by the CVSS vector (VC:L, VI:L, VA:L).
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's channels for updates. Until a patch is released, restricting access to the vulnerable component and employing web application firewalls with SQL injection detection rules may help mitigate exploitation risk.
CVE-2026-103231: SQL Injection in AdithyaYelloju Restaurant-Management-System
Description
CVE-2026-103231 is a SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System affecting the Order Cancellation component. The flaw exists in the mysqli_query function within User/cancel.php, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
CVSS v4.0
Score 6.9medium
Affected software
AdithyaYelloju
Restaurant-Management-System
cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c allows remote attackers to perform SQL injection via the ID parameter in the User/cancel.php file's mysqli_query function. The issue was reported early to the project, but no vendor response or patch has been provided. Exploit code is publicly available, increasing the risk of exploitation.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database through the Order Cancellation feature. This can lead to unauthorized data access, modification, or deletion. The vulnerability requires no privileges or user interaction but has limited scope and impact as indicated by the CVSS vector (VC:L, VI:L, VA:L).
Mitigation Recommendations
No official fix or patch is currently available as the vendor has not responded. Users should monitor the vendor's channels for updates. Until a patch is released, restricting access to the vulnerable component and employing web application firewalls with SQL injection detection rules may help mitigate exploitation risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-30T08:09:16.943Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abd368b2a4e24523d3a8d1c
Added to database: 09/30/2026, 16:19:23 UTC
Last enriched: 09/30/2026, 17:34:17 UTC
Last updated: 09/30/2026, 22:55:06 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.