EUVD-2026-13569Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | While the CVSS v3.1 score of 6.3 (Medium) reflects moderate severity with low complexity (AC:L) and network accessibility (AV:N), the real-world risk is elevated by several factors: public proof-of-concept availability increases exploitation probability; the vulnerability requires only low-level privileges (PR:L), meaning any authenticated user can exploit it; the disclosed nature suggests active reconnaissance and potential weaponization are underway. However, the requirement for prior authentication (PR:L) limits the attack surface compared to unauthenticated SQL injection. The impact is limited to confidentiality, integrity, and availability on a per-database level (S:U indicates no scope expansion), suggesting this is not a critical vulnerability but warrants prompt patching given the publicly available exploit and the sensitivity of supplier data in an ordering system. |
| Exploit ScenarioDerived | An authenticated user with access to the admin panel navigates to the supplier management page (/admin/admin_edit_supplier.php) and injects a SQL payload such as ' OR '1'='1 into the Supplier_Name field, bypassing intended SQL query structure. The malicious SQL is executed against the backend database, allowing the attacker to extract sensitive supplier data, customer information, or order details, or to modify pricing and supplier records. Given that a public proof-of-concept exists, attackers with valid credentials—either through credential theft, weak passwords, or insider access—can quickly exploit this vulnerability with minimal technical skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows authenticated remote attackers to manipulate the Supplier_Name parameter in /admin/admin_edit_supplier.php, potentially enabling data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in itsourcecode Online Frozen Foods Ordering System version 1.0 within the admin supplier editing functionality (/admin/admin_edit_supplier.php), where the Supplier_Name parameter is improperly sanitized. An authenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially allowing unauthorized data access, modification, or deletion. A public proof-of-concept has been disclosed, and the vulnerability is technically exploitable with relatively low complexity despite requiring authenticated access.
RemediationAI
The primary remediation is to contact itsourcecode for a patched version of Online Frozen Foods Ordering System 1.0 or upgrade to a newer version if available. Immediate technical controls should include: (1) applying input validation and output encoding to the Supplier_Name parameter and all user inputs in admin_edit_supplier.php, (2) implementing parameterized/prepared queries for all SQL operations to prevent injection, and (3) enforcing principle of least privilege for database accounts used by the application. As temporary workarounds pending patching, restrict administrative access to the /admin/ directory via network-level controls, limit admin account creation, and implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Supplier_Name parameter. Consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-4472 for official patch availability and detailed guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output ('Injection')) in a PHP-based web application. The root cause is insufficient input validation and parameterized query handling in the /admin/admin_edit_supplier.php file, where user-supplied input from the Supplier_Name parameter is concatenated directly into SQL queries without proper escaping or prepared statement usage. The affected product is itsourcecode Online Frozen Foods Ordering System 1.0, a PHP application designed for food ordering operations. The lack of proper prepared statements or parameterized query mechanisms allows attackers to break out of intended SQL syntax and execute arbitrary database operations.
Know when Online Frozen Foods Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /admin/admin_edit_supplier.php. The manipulation of the argument Supplier_Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Executive ViewAI
Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4472, a injection vulnerability rated CVSS 6.3. Exploitation could allow attackers to execute code or inject malicious input. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in itsourcecode Online Frozen Foods System Injection
View all 4Online Frozen Foods Ordering System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database que
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables r
Exploit-DB