---
id: "CVE-2026-115999"
kind: "vulnerability"
aliases: ["CVE-2026-115999"]
title: "Restaurant_IMS: SQL injection in lsmodal.php login_id lets attackers query the database"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Restaurant_IMS", "fixed": [], "affected": "commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 (rolling release, other commits unknown)", "ecosystem": "other"}]
ecosystems: []
tags: ["mysql", "other", "php", "restaurant-ims", "self-hosted"]
not_affected_if: ["lsmodal-not-exposed", "not-deployed"]
published_at: "2026-10-25T02:16:26+00:00"
first_seen_at: "2026-10-25T04:02:13+00:00"
updated_at: "2026-10-25T04:03:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115999", "first_seen_at": "2026-10-25T04:02:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:03:46+00:00"}]
---

# Restaurant_IMS: SQL injection in lsmodal.php login_id lets attackers query the database

The Restaurant_IMS project by mansi-k has an SQL injection flaw in the lsmodal.php file, where the login_id and epsw arguments are not sanitized before reaching a mysqli query. A remote attacker can send crafted input to read or change data in the application's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Restaurant_IMS affected commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 (rolling release, other commits unknown) fixed ?

## How to check

Look for lsmodal.php in the web root of your Restaurant_IMS deployment. Run 'git rev-parse HEAD' in the checkout: commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 is the one named in the CVE. Later commits are not confirmed fixed or vulnerable. Check whether the login_id and epsw values reach mysqli queries without prepared statements.

## Fix

No fix available. Vendor did not respond and the project is rolling-release with no patched version. Do not expose this app; if you must run it, rewrite the lsmodal.php login query to use mysqli prepared statements (bind login_id and epsw) and put authentication in front of it.

## Timeline

- 2026-10-25T04:02:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115999
- 2026-10-25T04:03:46+00:00 analyst — VulDB/NVD only; no vendor advisory, vendor silent, rolling release, no fix, no PoC or exploitation seen, no social chatter checked. Nothing verified.

## Documents

- [advisory] VulDB 426096: Restaurant_IMS lsmodal.php SQL injection https://vuldb.com/vuln/426096
- [describes] mansi-k/Restaurant_IMS repository https://github.com/mansi-k/restaurant_ims

## From the sources

A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_