CVE-2026-103229 is a High severity SQL injection in the open source PHP project Restaurant-Management-System by AdithyaYelloju. The admin/delete1.php script passes an ID parameter into a database query without protection, and no authentication is required. The project has no versions and no patch, so the fix is to rewrite the handlers or stop running it.
What's affected
- Product: Restaurant-Management-System, a PHP and MySQL web application by AdithyaYelloju, up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.
- Affected component: admin/delete1.php, where the ID argument reaches mysqli_query.
- Versions: none. The record says the project uses rolling releases and gives no affected or fixed version numbers.
- Fixed: not confirmed. The public issue was still open on the page I read, so check the repository for a later commit.
- Related: the public issue lists several more admin handlers with the same pattern.
How to check if you're exposed
There is no package to query, so check the code and the exposure.
git log -1 --format=%H
grep -rn "mysqli_query" admin/ | head -50
The first command shows the commit you run. Compare it with the commit named in the record. The second finds database calls in the admin folder. Look for any place where request input is placed directly inside the query string.
Then check whether the admin folder can be reached without a login. The issue reports that there is no session or role check in these handlers. A web server log search for requests to the admin scripts from unknown addresses will show whether anyone has been probing them. Also review database contents for missing or unexpected rows.
What to do now
- If you run this project anywhere reachable from the internet, take it offline or put the admin folder behind web server authentication now.
- Rewrite every database call that uses request input to use prepared statements with bound parameters.
- Add a real authentication and role check in front of every admin action, and use POST with a request token for deletes and approvals.
- Restore from a known good backup if you see unexplained deleted or changed rows.
- Use a database account with only the rights the application needs.
- Consider replacing the project with a maintained application if you need this for real business use.
Why it matters
The record lists CWE-89, SQL injection, and CWE-74, injection in general. The public issue shows the classic mistake: a request parameter is pasted into an SQL statement. Anything the visitor sends becomes part of the command the database runs.
The impact described is destructive. With no login check, the issue says any remote visitor could mass delete or update rows in the affected tables. The record also notes that a public exploit has been disclosed. The record does not say this is exploited in the wild, and it is not in the CISA catalog.
Projects like this are often tutorials or student work that end up deployed. The risk is real when they do. A dependency scan will not help when the weakness is in the application code itself, so code review and static analysis are the right tools.
Quick check
Is there a patched version?
None is confirmed. The project uses rolling releases and the record lists no fixed version, so check the repository for newer commits.
What is the safest short term step?
Take the application off the public internet or restrict the admin folder at the web server until the handlers are rewritten.
Sources
Last reviewed: 18 October 2026.
