A critical SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System allows authenticated attackers to extract sensitive database information and potentially achieve remote code execution.

This is a classic SQL injection flaw (CWE-89) where the application uses direct string interpolation of the s1 POST parameter within a SQL query. The vulnerability is reachable by any authenticated user, including standard users, who can leverage UNION-based payloads to bypass intended query constraints and exfiltrate data.

The vulnerability poses a severe risk to data confidentiality and integrity. Successful exploitation allows an attacker to dump sensitive information from the database, including administrator credentials and user records, which may contain plaintext passwords. Given the potential for stacked queries, this flaw could escalate to full system compromise or remote code execution, justifying the high severity assessment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the administration interface to trusted internal networks only. Users are advised to monitor the vendor GitHub repository for updates and apply them immediately upon release.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to admin/display_menu.php and admin/tables.php, specifically searching for SQL syntax characters such as UNION, SELECT, and comment indicators.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests containing SQL injection patterns in the s1 parameter. This serves as a vital virtual patch while an official code-level fix is awaited.

Public Exploit Available: Yes — a functional proof-of-concept is documented in the GitHub issue report provided by the researcher.

The vulnerability is highly critical due to the ease of exploitation and the depth of data access it provides to unauthorized users. Because the vendor has not yet responded to the report or provided a patch, immediate manual intervention is required. Administrators must restrict exposure of the management interface to mitigate the risk of exploitation until an upstream fix is developed and deployed.