Online Food Ordering System CVE-2026-30530

Remote unauthenticated attacker can inject SQL via the 'username' parameter in the save_customer action of Actions.php in SourceCodester Online Food Ordering System v1.0. No special configuration or user interaction required.

The risk profile is elevated due to multiple converging signals. Although CVSS score and vector data are unavailable, the vulnerability type (SQL injection) is inherently high-severity because it permits direct database manipulation and potential data exfiltration, authentication bypass, and data modification. The availability of publicly available exploit code substantially increases real-world risk, as exploitation barriers are lowered for both opportunistic and targeted attackers. Without CVSS vector details, authentication requirements cannot be confirmed from the provided data; however, SQL injection in user registration/customer creation endpoints typically requires no authentication. The lack of patch version information suggests either no vendor-released patch is currently available or the vendor status is unconfirmed. Given the public PoC availability and the application's common deployment in small-to-medium business environments with limited security postures, this vulnerability warrants immediate prioritization despite the absence of CVSS quantification.

An attacker submits a crafted HTTP request to the save_customer action with a malicious SQL payload embedded in the username parameter, such as username=admin' OR '1'='1 or username='; DROP TABLE customers; --. Since the application concatenates this unsanitized input directly into a SQL query without prepared statements, the injected SQL commands execute against the backend database. The attacker can extract sensitive customer data, modify records, bypass authentication checks, or escalate privileges. Publicly available exploit code from the referenced GitHub repository provides ready-made payloads that lower the attack difficulty, making this accessible to attackers with basic web application knowledge.