What is the CVSS score of CVE-2026-30532?

CVE-2026-30532 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30532?

Organizations using SourceCodester Online Food Ordering System face critical risk from CVE-2026-30532, a SQL injection vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2026-30532?

Yes, a public proof-of-concept exploit is available for CVE-2026-30532. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30532?

Within 24 hours: Identify all affected systems running SourceCodester Online Food Ordering System and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-30532

EUVD-2026-16680 CRITICAL

SQL Injection (CWE-89)

2026-03-27 mitre

GHSA-5c2c-q7c7-hq3r

SQLi PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 18:17 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 15:30 euvd

EUVD-2026-16680

Analysis Generated

Mar 27, 2026 - 15:30 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" parameter.

Articles & Coverage 1

vuln.today Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge Mar 30, 2026

AnalysisAI

SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL queries through the 'id' parameter in admin/view_product.php, enabling unauthorized database access and potential data exfiltration. The vulnerability affects the administrative interface and publicly available exploit code exists, increasing real-world exploitation risk despite the absence of formal CVSS scoring.

Technical ContextAI

The vulnerability is a classic SQL injection flaw in a PHP-based web application. The admin/view_product.php script fails to properly sanitize or parameterize the 'id' query parameter before incorporating it into SQL statements, allowing attackers to inject malicious SQL syntax. This represents a CWE-89 (SQL Injection) root cause, a well-understood and fundamentally preventable class of vulnerability. The affected product, SourceCodester Online Food Ordering System, is a PHP application typically deployed on LAMP or similar stacks. The CPE data provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) indicates incomplete vendor/product identification in official databases, which is common for less-maintained open-source or semi-commercial projects.

RemediationAI

Immediate action: upgrade to a patched version of SourceCodester Online Food Ordering System if available from the vendor; however, no specific vendor-released patch version is confirmed in the provided data. Primary remediation is to implement parameterized queries (prepared statements) in admin/view_product.php to eliminate SQL injection. Additionally, enforce principle of least privilege on database credentials used by the admin interface, restrict access to admin/ paths via network firewall or WAF rules to trusted administrative IP ranges, implement input validation to reject unexpected 'id' parameter formats, and deploy a Web Application Firewall with SQL injection signatures. Immediate containment: restrict network access to the admin interface and review logs for exploitation attempts using patterns from the public POC at the GitHub reference.