Which versions of PHP are affected by CVE-2026-4319?

A publicly exploited SQL injection vulnerability in Simple Food Order System 1.0 allows remote attackers to manipulate database queries through the price parameter, potentially exposing or modifying…

Is there a public PoC exploit available for CVE-2026-4319?

Yes, a public proof-of-concept exploit is available for CVE-2026-4319. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4319?

Within 24 hours: Identify all systems running Simple Food Order System 1.0 and isolate affected instances from production networks if possible. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious SQL injection payloads targeting /routers/add-item.php and disable the price parameter if functionality permits. Within 30 days: Migrate to an alternative food ordering system or contact the vendor for security updates; conduct forensic analysis to determine if exploitation has occurred.

PHP CVE-2026-4319

Q: What is the CVSS score of CVE-2026-4319?

CVE-2026-4319 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-12588 MEDIUM

SQL Injection (CWE-89)

2026-03-17 VulDB

PHP SQLi Simple Food Order System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 08, 2026 - 21:02 vuln.today

Public exploit code

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12588

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 17:02 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was identified in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/add-item.php. Such manipulation of the argument price leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in Simple Food Order System 1.0's /routers/add-item.php endpoint allows unauthenticated remote attackers to manipulate the price parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and could lead to unauthorized data access, modification, or deletion.

Technical ContextAI

This vulnerability affects code-projects Simple Food Order System 1.0 (CPE: cpe:2.3:a:code-projects:simple_food_order_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing food orders. The root cause is CWE-89 (SQL Injection), where user-supplied input in the 'price' argument of the add-item.php router is incorporated into SQL queries without proper validation or parameterized query usage. This allows attackers to inject malicious SQL statements that the database executes with the application's privileges, potentially enabling unauthorized data access, modification, or deletion.

RemediationAI

No official patch or updated version from code-projects has been identified in available references. Organizations should immediately discontinue use of Simple Food Order System 1.0 in production environments and migrate to a maintained, secure alternative for food ordering functionality. If continued use is unavoidable, implement input validation and parameterized queries for the /routers/add-item.php file, specifically sanitizing the 'price' parameter using prepared statements or stored procedures. Deploy a web application firewall (WAF) with SQL injection detection rules to block exploitation attempts targeting this endpoint. Restrict network access to the application to trusted IP ranges and implement database-level privilege separation to limit damage from successful exploitation. Monitor VulDB advisories at https://vuldb.com/?id.351363 and https://vuldb.com/?ctiid.351363 for any vendor response or community patches.