| Title | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Information Exposure Through Error Message |
|---|
| Description | The affected components are any page that runs `mysqli_*` calls on user input without checking the result. Two concrete examples observed in the lab:
1. `User/ord.php` — when `?id=` does not match a menu row, `mysqli_fetch_array()` is called on `bool` from a failed `mysqli_query`. PHP emits the warning directly into the response, including the absolute server path of the script:
```
<br />
<b>Warning</b>: mysqli_fetch_array() expects parameter 1 to be mysqli_result, bool given in <b>/www/wwwroot/foodcorner/User/ord.php</b> on line <b>13</b><br />
<br />
<b>Warning</b>: A non-numeric value encountered in <b>/www/wwwroot/foodcorner/User/ord.php</b> on line <b>20</b><br />
```
2. `User/ord_t.php` — the same warning fires, and **additionally** the file actively executes `echo $sql;` (not commented out, unlike `User/ord.php`'s `//echo $sql;`). The full INSERT string with the user's inputs is returned to the caller:
```
<br />
<b>Warning</b>: mysqli_fetch_array() expects parameter 1 to be mysqli_result, bool given in <b>/www/wwwroot/foodcorner/User/ord_t.php</b> on line <b>9</b><br />
insert into t_order values('','',,'','',,,'','pending..',)
```
The same pattern appears in many scripts that interpolate user input into SQL strings without first checking that `mysqli_query` returned a valid result — `admin/display_menu.php` (search), `admin/tables.php` (search), `admin/orders.php`, `admin/t_orders.php`, etc. Any malformed input (or any input that triggers the SQL-injection chain) produces a PHP warning that discloses:
- The server's internal path (`/www/wwwroot/foodcorner/User/...`)
- The DB server's interpretation of the input (which gives defenders a free oracle for the SQLi primitives in CVE-04/CVE-05/CVE-06/CVE-07)
The CWE label is **Information Exposure Through Error Message** (CWE-209). The active `echo $sql;` is also a developer-debug leftover that prints the entire query, including values, to the client.
|
|---|
| Source | ⚠️ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/14 |
|---|
| User | 100001001X (UID 100909) |
|---|
| Submission | 09/01/2026 13:47 (2 months ago) |
|---|
| Moderation | 10/12/2026 11:39 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 411923 [AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Order Placement User/ord.php mysqli_query id/name sql injection] |
|---|
| Points | 0 |
|---|