CVE-2026-95868: Restaurant Management System SQL Injection

CVE-2026-95868 Overview

CVE-2026-95868 is a SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System project. The flaw resides in the mysqli_query call within admin/display_menu.php, where the s1 parameter of the Search Form is passed to the database without sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The project follows a continuous delivery model with rolling releases, so no discrete affected or fixed version identifiers are published. A public exploit has been disclosed, and the maintainer has not responded to the upstream issue report.

Critical Impact
Authenticated remote attackers can inject SQL through the s1 search parameter to read, modify, or delete backend database records handled by admin/display_menu.php.

Affected Products

AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c
Component: Search Form in admin/display_menu.php
Vulnerable function: mysqli_query invoked with the s1 argument

Discovery Timeline

2026-09-23 - CVE-2026-95868 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95868

Vulnerability Analysis

The vulnerability is a classic SQL injection classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The admin/display_menu.php script accepts a user-controlled search value in the s1 parameter and concatenates it directly into a SQL query executed by mysqli_query. Because no parameterized query, prepared statement, or input sanitization is applied, an attacker can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access to the admin search interface. The impact spans confidentiality, integrity, and availability of the backing database, though at a limited scope consistent with the reported metrics. The project uses rolling releases, so no fixed version identifier exists, and the maintainer has not acknowledged the upstream GitHub issue #4. Public exploit details are available through VulDB entry 408542. EPSS data currently places exploitation probability at 0.242%.

Root Cause

The root cause is unsafe query construction. The s1 request parameter is embedded directly into a SQL string passed to mysqli_query without escaping, binding, or type validation. PHP-native parameterized APIs such as mysqli_prepare with bound parameters would prevent user input from altering query syntax.

Attack Vector

An attacker sends a crafted HTTP request to the menu search endpoint containing SQL metacharacters in the s1 parameter. Because the attack path requires low privileges but no user interaction, any authenticated user with access to the admin search form can trigger the injection remotely. Depending on database privileges, the attacker can enumerate tables, exfiltrate records, modify menu data, or issue destructive statements.

No verified proof-of-concept code is reproduced here. Technical details are documented in the VulDB advisory for CVE-2026-95868.

Detection Methods for CVE-2026-95868

Indicators of Compromise

HTTP requests to admin/display_menu.php containing SQL metacharacters such as single quotes, UNION, SELECT, --, or OR 1=1 in the s1 parameter
Web server or application logs showing MySQL syntax errors originating from the menu search handler
Unexpected changes to menu records or unusual read volumes against tables referenced by display_menu.php

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the s1 query parameter for SQL injection payloads and boolean-based tautologies
Enable MySQL general query logging temporarily during triage to correlate suspicious search inputs with executed statements
Alert on repeated 500-class responses tied to admin/display_menu.php requests, which frequently accompany injection probes

Monitoring Recommendations

Forward web server, PHP error, and MySQL logs to a centralized analytics platform for correlation across the admin interface
Baseline normal search parameter length and character sets, then alert on outliers containing SQL keywords or comment sequences
Monitor database user accounts used by the application for privilege changes or unusual query patterns outside business hours

How to Mitigate CVE-2026-95868

Immediate Actions Required

Restrict network access to admin/display_menu.php to trusted administrators using authentication, IP allowlisting, or a VPN
Deploy WAF signatures blocking SQL injection payloads in the s1 parameter until a code fix is applied
Rotate database credentials used by the application and reduce the MySQL user's privileges to the minimum required by the application

Patch Information

No official patch is available. The maintainer has not responded to the upstream report at GitHub issue #4. Because the project uses continuous rolling releases, operators must self-patch by replacing the vulnerable mysqli_query call in admin/display_menu.php with a prepared statement using mysqli_prepare and bound parameters, and by validating that s1 contains only expected characters.

Workarounds

Temporarily disable the menu search feature or the entire admin endpoint if it is not business-critical
Add a server-side input filter that rejects requests where s1 contains characters outside an allowlisted set such as alphanumerics and spaces
Fork the repository and apply an in-house patch that converts the affected query to a parameterized statement, then deploy from the internal fork

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:s1 "@rx (?i)(union(\s|/\*.*?\*/)+select|--|;|/\*|\bor\b\s+\d+=\d+)" \
  "id:1029586,phase:2,deny,status:403,msg:'CVE-2026-95868 SQLi attempt on s1'"