What is the CVSS score of CVE-2026-30533?

CVE-2026-30533 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30533?

Organizations using SourceCodester Online Food Ordering System face critical risk from CVE-2026-30533, a SQL injection vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2026-30533?

Yes, a public proof-of-concept exploit is available for CVE-2026-30533. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30533?

Within 24 hours: Identify all affected systems running SourceCodester Online Food Ordering System and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-30533

EUVD-2026-16682 CRITICAL

SQL Injection (CWE-89)

2026-03-27 mitre

GHSA-gjcq-c94g-v7g2

SQLi PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 18:17 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 15:30 euvd

EUVD-2026-16682

Analysis Generated

Mar 27, 2026 - 15:30 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id" parameter.

Articles & Coverage 1

vuln.today Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge Mar 30, 2026

AnalysisAI

SQL injection in SourceCodester Online Food Ordering System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands through the 'id' parameter in admin/manage_product.php, enabling unauthorized database access and data exfiltration. Publicly available exploit code exists for this vulnerability; however, no CVSS score, EPSS data, or CISA KEV confirmation is available to assess active exploitation at scale.

Technical ContextAI

The vulnerability exploits unsafe SQL query construction in a PHP web application where user-supplied input from the 'id' parameter is concatenated directly into SQL statements without parameterized queries or proper input sanitization. This is a classic SQL injection (SQLi) attack surface in the admin module, likely affecting database operations in manage_product.php. The root cause falls under CWE category SQL Injection, a fundamental input validation failure. SourceCodester Online Food Ordering System v1.0 is the affected product; the absence of CPE vendor/product standardization in the provided data prevents precise cross-reference with downstream dependency databases, but the product is identified as a PHP-based e-commerce platform.

RemediationAI

Immediate remediation requires upgrading SourceCodester Online Food Ordering System to a patched version if available from the vendor; however, no specific patched release version is documented in the available data. Until a vendor patch is confirmed and deployed, implement the following mitigations: (1) Use parameterized queries or prepared statements (e.g., mysqli_prepare or PDO prepared statements) to replace all dynamic SQL construction in manage_product.php; (2) enforce strict input validation on the 'id' parameter to accept only expected numeric or alphanumeric formats; (3) restrict access to the admin module via network-layer controls (VPN, IP whitelisting) and enforce strong authentication; (4) enable database query logging and alerting to detect anomalous SQL activity; (5) apply principle of least privilege to the database user account under which the application runs. Contact the SourceCodester vendor directly for patch availability and timeline.