What is the CVSS score of CVE-2026-30531?

CVE-2026-30531 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30531?

Organizations using SourceCodester Online Food Ordering System face significant risk from CVE-2026-30531, a SQL injection vulnerability rated CVSS 8.8.

Is there a public PoC exploit available for CVE-2026-30531?

Yes, a public proof-of-concept exploit is available for CVE-2026-30531. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30531?

Within 7 days: Identify all affected systems running SourceCodester Online Food Ordering System and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-30531

EUVD-2026-16678 HIGH

SQL Injection (CWE-89)

2026-03-27 mitre

SQLi PHP

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 18:18 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:00 euvd

EUVD-2026-16678

Analysis Generated

Mar 27, 2026 - 16:00 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_category action). The application fails to properly sanitize user input supplied to the "name" parameter. This allows an authenticated attacker to inject malicious SQL commands.

AnalysisAI

SQL injection in SourceCodester Online Food Ordering System v1.0 allows authenticated attackers to inject arbitrary SQL commands through the unvalidated 'name' parameter in the save_category action of Actions.php. The vulnerability affects the application's category management functionality and enables data exfiltration, modification, or deletion. Publicly available exploit code exists demonstrating the vulnerability, increasing practical exploitation risk despite authentication requirement.

Technical ContextAI

The vulnerability exists in PHP-based web application code within the Actions.php file, specifically in the save_category action handler. The root cause is improper input sanitization for the 'name' parameter, classified under CWE-89 (SQL Injection), allowing attackers to break out of intended SQL query context and execute arbitrary database commands. SourceCodester Online Food Ordering System v1.0 is the affected product, though the generic CPE provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) does not provide vendor-specific identification, limiting precise product enumeration. The application likely uses a backend database system (MySQL, PostgreSQL, or similar) without prepared statements or parameterized queries for the affected action.

RemediationAI

Immediate action should focus on upgrading SourceCodester Online Food Ordering System beyond version 1.0 to a patched release that includes input validation and sanitization (consult the vendor for the specific fixed version). Until patching is possible, implement database-level mitigations: enforce principle of least privilege for database user accounts associated with the application, restrict database user permissions to only necessary stored procedures and tables, and implement parameterized queries or prepared statement patterns in the Actions.php save_category action. Additionally, restrict access to the category management functionality to trusted administrators only, implement comprehensive logging of all category modification actions for audit purposes, and monitor database query logs for suspicious SQL patterns. Given the authentication requirement, strengthen access controls and credential management for application user accounts.