Online Frozen Foods Ordering System CVE-2026-4471

The CVSS 3.1 score of 4.7 reflects a moderate severity rating with a network attack vector (AV:N), low attack complexity (AC:L), and high privilege requirement (PR:H), resulting in limited confidentiality, integrity, and availability impact (C:L/I:L/A:L). However, the risk assessment must account for critical exploitation indicators: a public proof-of-concept exists (referenced in the GitHub issue), the application is a commercial ordering system likely handling payment and customer data, and the vulnerability is in the admin interface where data sensitivity is high. The privilege requirement (PR:H) significantly constrains exploitation to compromised or rogue administrators, which reduces the real-world attack surface compared to unauthenticated SQL injection. The EUVD tracking and public disclosure timeline suggest this is a known, catalogued vulnerability with mature documentation. While EPSS data is not provided in the intelligence sources, the combination of POC availability and authentication requirement suggests this is a targeted insider threat or post-compromise persistence vector rather than a mass-exploitation vulnerability. The real priority should be elevated beyond the base CVSS score due to data sensitivity in a financial/ordering context, but the authentication gate prevents it from being critical.

An attacker with legitimate or stolen administrator credentials logs into the admin panel and navigates to the employee editing interface (/admin/admin_edit_employee.php). Rather than entering a normal employee name in the First_Name field, they submit a SQL injection payload such as: "Robert' OR '1'='1"; DROP TABLE employees; --" which causes the application to execute unintended SQL commands against the backend database. Depending on the database user's privileges, this could result in exfiltration of customer data (names, addresses, payment information), modification of order records, or deletion of critical system tables. A public proof-of-concept (referenced in the GitHub issue) further reduces the barrier to entry for attackers discovering this weakness post-disclosure.