Online Food Ordering System CVE-2026-30529

Authenticated attacker with user account access to SourceCodester Online Food Ordering System v1.0. Exploit targets the save_user action in Actions.php via unsanitized 'username' parameter. No victim interaction required; attacker directly submits malicious SQL in POST/GET request.

Risk assessment is constrained by missing CVSS and EPSS data. However, contextual signals indicate moderate risk: (1) Exploit Code: Publicly available POC exists (GitHub reference provided), indicating low barrier to exploitation; (2) Authentication Requirement: The vulnerability is authenticated-only (requires valid user login), which reduces attack surface compared to unauthenticated SQLi; (3) Impact: SQL injection on an authenticated account can lead to data exfiltration, modification, or privilege escalation depending on database permissions and application design; (4) KEV/Active Exploitation: No CISA KEV status provided, suggesting no confirmed active exploitation campaigns at time of disclosure; (5) SSVC Decision Framework: Given authenticated access requirement, public POC availability, and unknown technical impact scope, this presents manageable but not critical risk for organizations that restrict application access and apply timely patching. Organizations with exposed instances or permissive access controls face higher risk.

An authenticated attacker with valid user credentials logs into the Online Food Ordering System and navigates to a user profile or settings page where the username can be modified. Instead of entering a normal username, the attacker injects SQL code such as username=admin' OR '1'='1 or username=admin'; DROP TABLE users;-- into the username parameter. Because the application does not sanitize this input before passing it to a SQL query, the injected SQL is executed with the database connection privileges of the application. Publicly available exploit code from GitHub demonstrates this attack flow. Depending on database permissions, the attacker could read sensitive user data, modify records, or potentially escalate privileges.