EUVD-2026-13565Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | While the CVSS 3.1 score of 4.7 indicates a medium baseline severity, this rating reflects the requirement for high-privilege authentication (Admin/PR:H), which significantly reduces real-world exploitability. However, several factors elevate practical risk: the vulnerability has been publicly disclosed with working proof-of-concept code available, increasing likelihood of active exploitation; the CVSS vector shows relatively low attack complexity (AC:L) once authenticated; the vulnerability impacts confidentiality, integrity, and availability equally (C:L/I:L/A:L). The main mitigating factor is the requirement for administrative credentials—an attacker must first compromise or have legitimate admin access. Organizations using this system with weak credential hygiene, shared admin accounts, or exposed admin panels face significantly higher real-world risk than the CVSS score suggests. Given public POC availability and the authenticated but remotely exploitable nature, this warrants prompt patching despite the moderate CVSS rating. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials (obtained through credential theft, insider threat, or weak password recovery) logs into the application and navigates to the menu editing interface. In the product_name field, instead of entering a normal product name, the attacker injects a SQL payload such as: admin' OR '1'='1' UNION SELECT password FROM users--. The unsanitized input is directly inserted into the backend SQL query, breaking the intended query logic and executing the attacker's injected commands. This allows the attacker to extract sensitive data such as user credentials, modify menu items maliciously, or delete critical ordering records. The public availability of working exploit code means this attack can be executed without significant technical sophistication once administrative access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers with high privileges to manipulate the product_name parameter in /admin/admin_edit_menu.php, enabling unauthorized data access and modification. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The affected PHP application currently lacks an available patch.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in itsourcecode Online Frozen Foods Ordering System version 1.0 within the administrative interface file /admin/admin_edit_menu.php. An authenticated attacker with high privileges can manipulate the product_name parameter to inject malicious SQL commands, potentially allowing unauthorized data access, modification, or deletion. Public exploit code has been released and the vulnerability is confirmed to be remotely exploitable, though it requires valid administrative credentials to trigger.
RemediationAI
The primary remediation is to contact itsourcecode for availability of patches or updates to version 1.0, as no official patch version has been publicly released at this time. If a patched version becomes available, upgrade immediately. In the interim, implement the following compensating controls: restrict administrative access to /admin/admin_edit_menu.php to trusted IP addresses only via firewall or web application firewall rules; enforce strong, unique credentials for all administrative accounts and disable credential sharing; implement input validation and output encoding at the application layer if vendor source code is accessible (specifically, use parameterized SQL queries and escape the product_name parameter); monitor database logs and application logs for suspicious SQL patterns; consider running the application on a segmented network with limited database connectivity. Additionally, review the public POC at https://github.com/sjkdhl/public/issues/3 and https://vuldb.com/?id.351760 to understand the exact attack methodology and verify if your implementation is affected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as 'Injection'), manifesting specifically as SQL injection in a PHP-based web application. The affected component is the admin_edit_menu.php file within a menu management system, where user-supplied input via the product_name parameter is directly concatenated into SQL queries without proper parameterization or prepared statements. This is a classic PHP/SQL vulnerability pattern where inadequate input validation and lack of parameterized queries allow attackers to break out of the intended SQL context and execute arbitrary database commands.
Know when Online Frozen Foods Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_name results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Organizations using A security flaw should be aware of moderate risk from CVE-2026-4470, a injection vulnerability rated CVSS 4.7. Exploitation could allow attackers to execute code or inject malicious input. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in itsourcecode Online Frozen Foods System Injection
View all 4Online Frozen Foods Ordering System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database que
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables r
Exploit-DB