SQL injection in mansi-k Restaurant_IMS lsmodal.php
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
The mansi-k Restaurant_IMS product is affected at commit d7ad49f, as the sources give no version details. Manipulating the login_id and epsw arguments in lsmodal.php lets input reach the mysqli_connect function without neutralization, causing SQL injection (CWE-89). A remote attacker needs no privileges or user interaction and can gain low confidentiality, integrity and availability impact.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mansi-k | Restaurant_IMS | d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 | — | No fix listed | CNA |
- Restaurant_IMS Vendormansi-k Affected d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mansi-k:restaurant_ims:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:mansi-k:restaurant_ims:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for mansi-k Restaurant_IMS.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-25 Threatist record created from CVE-2026-115999
- 2026-10-25 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-mv73-9vhw-8f9j
- 2026-10-29 CISA SSVC decision points changed
References
—
Sources
- CVE-2026-115999 · CVE Program
- CVE-2026-115999 · NVD
- FIRST EPSS
- GHSA-mv73-9vhw-8f9j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences