What is the CVSS score of CVE-2026-30529?

CVE-2026-30529 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30529?

Organizations using SourceCodester Online Food Ordering System face significant risk from CVE-2026-30529, a SQL injection vulnerability rated CVSS 8.8.

Is there a public PoC exploit available for CVE-2026-30529?

Yes, a public proof-of-concept exploit is available for CVE-2026-30529. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30529?

Within 7 days: Identify all affected systems running SourceCodester Online Food Ordering System and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-30529

EUVD-2026-16674 HIGH

SQL Injection (CWE-89)

2026-03-27 cve@mitre.org

PHP SQLi Online Food Ordering System Oretnom23

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 17:21 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:22 euvd

EUVD-2026-16674

Analysis Generated

Mar 27, 2026 - 16:22 vuln.today

CVE Published

Mar 27, 2026 - 16:16 nvd

HIGH 8.8

DescriptionCVE.org

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an authenticated attacker to inject malicious SQL commands.

AnalysisAI

SQL injection in SourceCodester Online Food Ordering System v1.0 allows authenticated attackers to execute arbitrary SQL commands via the username parameter in Actions.php (save_user action), due to improper input sanitization. Publicly available exploit code exists demonstrating this vulnerability. While CVSS and EPSS scores are unavailable, the authenticated requirement and public POC availability indicate moderate real-world risk for deployments with user account access.

Technical ContextAI

The vulnerability exists in server-side PHP code processing user input without parameterized queries or sufficient sanitization. The affected component is the save_user action handler in Actions.php, which accepts a username parameter that is concatenated directly into SQL statements. This violates CWE-89 (SQL Injection) best practices, which mandate use of prepared statements with bound parameters. The root cause is improper handling of untrusted user-supplied data in database queries. SourceCodester Online Food Ordering System v1.0 is a PHP-based web application (likely identifiable via CPE as cpe:2.3:a:sourcecodester:online_food_ordering_system), and the vulnerability affects the database interaction layer that authenticates and updates user records.

RemediationAI

Patch availability for this vulnerability has not been confirmed from the provided data. Immediate remediation steps include: (1) Upgrade SourceCodester Online Food Ordering System to a patched version if available from the vendor; (2) If patching is not immediately possible, implement input validation on the username parameter using a whitelist of allowed characters (alphanumeric and safe symbols only), rejecting any input containing SQL metacharacters; (3) Enforce use of prepared statements with parameterized queries in Actions.php for all database operations; (4) Restrict network access to the application to trusted user ranges and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns; (5) Apply principle of least privilege to database user accounts used by the application, limiting permissions to only required tables and operations. Consult the GitHub PoC reference and SourceCodester project repository for patch or update availability.