This vulnerability involves an SQL injection in the yashpokharna2555 restaurent-management-system within the /forgotpassword.php component. The injection occurs through manipulation of the email POST parameter, enabling remote attackers to execute unauthorized SQL commands. The product lacks versioning, preventing identification of specific affected or unaffected versions. The vendor has been notified but has not issued any remediation or patch. The CVSS 4.0 base score is 6.9, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database via the email parameter in the forgot password functionality. This may lead to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or provided a fix. Until a patch is available, users should consider implementing input validation or parameterized queries on the email parameter in /forgotpassword.php to mitigate SQL injection risks.