This vulnerability exists in the AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The flaw is in the mysqli_query call within admin/table_booking.php where the 'Name' parameter is not properly sanitized, enabling SQL injection attacks remotely. The exploit has been publicly released, increasing the risk of exploitation. The vendor has been notified but has not issued any patch or mitigation guidance to date.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to data leakage, modification, or deletion. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, but limited confidentiality, integrity, and availability impacts.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'Name' parameter in admin/table_booking.php. Avoid exposing the vulnerable interface to untrusted networks if possible.