Which versions of PHP are affected by CVE-2026-4615?

An unauthenticated remote SQL injection vulnerability in SourceCodester Online Catering Reservation v1.0 allows attackers to extract, modify, or delete database records without authorization.

How to fix or mitigate CVE-2026-4615?

Within 24 hours: Isolate affected systems from production or restrict network access to the /search.php endpoint; document all instances of this application in use. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'rcode' parameter; conduct database audit for unauthorized access logs. Within 30 days: Migrate to an alternative catering reservation system from a vendor with active security support, or conduct comprehensive code remediation and security testing if the application is custom-developed.

PHP CVE-2026-4615

Q: What is the CVSS score of CVE-2026-4615?

CVE-2026-4615 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14662 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-24 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 24, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Apr 24, 2026 - 16:37 NVD

7.3 (HIGH) 6.9 (MEDIUM)

EUVD ID Assigned

Mar 24, 2026 - 00:22 euvd

EUVD-2026-14662

Analysis Generated

Mar 24, 2026 - 00:22 vuln.today

CVE Published

Mar 24, 2026 - 00:16 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in SourceCodester Online Catering Reservation 1.0. Impacted is an unknown function of the file /search.php. Such manipulation of the argument rcode leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in SourceCodester Online Catering Reservation 1.0 via the rcode parameter in /search.php allows unauthenticated remote attackers to manipulate database queries with no user interaction required. The vulnerability enables attackers to read, modify, or delete sensitive data, and public exploit code is readily available. PHP-based deployments of this catering reservation system are actively targeted due to the ease of exploitation and lack of available patches.

Technical ContextAI

This vulnerability affects SourceCodester Online Catering Reservation 1.0, a PHP-based web application for managing catering reservations. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which manifests as SQL injection through insufficient input validation on the 'rcode' parameter in the search.php file. The application appears to directly incorporate user-supplied input into SQL queries without proper sanitization, parameterization, or escaping, allowing attackers to break out of the intended query structure and execute arbitrary database commands. The vulnerability is exploitable through standard HTTP requests targeting the search functionality, a common attack surface in web applications.

RemediationAI

Immediately discontinue use of SourceCodester Online Catering Reservation 1.0 if deployed in production environments, as no patch information is currently available from the vendor. Organizations should review the proof-of-concept at https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_5.md to understand the attack mechanism and implement input validation as a temporary mitigation, specifically sanitizing the 'rcode' parameter in search.php using parameterized queries or prepared statements. Deploy a web application firewall (WAF) with SQL injection signatures to block exploitation attempts targeting /search.php, and restrict access to the application to authenticated users on trusted networks only. Monitor database logs for suspicious query patterns including SQL syntax characters in search parameters. Consider replacing the application with a maintained alternative that receives regular security updates, as community-sourced code from platforms like SourceCodester may lack ongoing vendor support for security patches.