CVE-2026-109115: SQL Injection in AdithyaYelloju Restaurant-Management-System

This vulnerability exists in the AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. It affects the password reset functionality in the file User/forgot3.php, where improper sanitization of the email/password parameters leads to SQL injection. The vulnerability can be exploited remotely without authentication. The project was notified but has not issued a fix or response. Due to the continuous delivery model with rolling releases, no discrete version numbers are available to identify affected or patched releases. Public exploit code is available.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database with limited privileges. This may lead to unauthorized data access, data modification, or denial of service. The vulnerability is remotely exploitable without authentication, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the password reset functionality or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the email/password parameters.