What is the CVSS score of CVE-2026-30534?

CVE-2026-30534 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-30534?

Organizations using SourceCodester Online Food Ordering System face notable risk from CVE-2026-30534, a SQL injection vulnerability rated CVSS 8.3.

Is there a public PoC exploit available for CVE-2026-30534?

Yes, a public proof-of-concept exploit is available for CVE-2026-30534. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30534?

Within 7 days: Identify all affected systems running SourceCodester Online Food Ordering System and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2026-30534

EUVD-2026-16684 HIGH

SQL Injection (CWE-89)

2026-03-27 mitre

GHSA-7c65-62fp-cwvv

PHP SQLi N A

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 18:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 15:30 euvd

EUVD-2026-16684

Analysis Generated

Mar 27, 2026 - 15:30 vuln.today

CVE Published

Mar 27, 2026 - 00:00 nvd

HIGH 8.3

DescriptionCVE.org

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage_category.php via the "id" parameter.

AnalysisAI

SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to manipulate database queries through the 'id' parameter in admin/manage_category.php, enabling unauthorized data extraction, modification, or deletion. The vulnerability affects the administrative interface and has publicly available exploit code, presenting immediate risk to deployed instances of this e-commerce platform.

Technical ContextAI

The vulnerability exists in a PHP-based web application (SourceCodester Online Food Ordering System) where user-supplied input from the 'id' parameter is passed unsanitized into SQL queries executed against the backend database. This is a classic SQL injection vulnerability (CWE category) in which an attacker can inject arbitrary SQL metacharacters and commands. The affected file admin/manage_category.php processes category management functions, likely using GET or POST parameters to retrieve or modify database records. The lack of input validation, parameterized queries, or prepared statements allows direct SQL manipulation. CPE designation indicates this is a commercial or open-source food ordering system, though vendor details (cpe:2.3:a:n/a:n/a) suggest incomplete vendor identification in public records.

RemediationAI

No vendor-released patch has been independently confirmed at time of analysis. Immediate remediation should prioritize upgrading SourceCodester Online Food Ordering System to the latest available version (contact vendor or check SourceCodester official repository for patched releases). If upgrade is not immediately feasible, implement emergency controls: (1) restrict network access to admin/manage_category.php using firewall rules or reverse proxy to trusted IP ranges only; (2) apply Web Application Firewall (WAF) rules to block SQL injection patterns in the 'id' parameter (common patterns include single quotes, UNION, --, /*, xp_, sp_); (3) enable database query logging and intrusion detection to identify exploitation attempts; (4) enforce strong authentication and multi-factor authentication on admin accounts; (5) implement input validation and parameterized queries (prepared statements) in the application code if source code access is available. Monitor the public PoC repository and vendor channels for patched version announcements.