This vulnerability exists in the AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. It affects the mysqli_query function in the admin/add_table.php file, where manipulation of the table, members, or price parameters can lead to SQL injection. The attack can be performed remotely without user interaction and requires low attack complexity and privileges. The project follows a rolling release model, so no discrete version numbers are provided for affected or patched releases. The vendor has not responded to the issue report, and no official patch or remediation guidance is available. Public exploit code exists.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 4.0 base score of 5.3 (medium), indicating moderate impact with low attack complexity and no user interaction required. The presence of public exploit code increases the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the project. Until a patch is released, consider restricting access to the affected functionality or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the affected parameters.