EUVD-2026-16085
GHSA-2w66-j4vc-q66r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The real-world risk is HIGH and warrants immediate attention. The CVSS v3.1 score of 7.3 reflects network-based attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), making it trivially exploitable. The exploit maturity is rated as Proof-of-Concept (E:P), confirmed by the publicly available GitHub exploit at https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_9.md. While EPSS data is not explicitly provided, public POC availability significantly elevates exploitation probability. The vulnerability is automatable and requires minimal technical skill, allowing attackers to scan for and exploit vulnerable instances at scale. The impact spans all three security pillars (C:L/I:L/A:L), enabling data exfiltration, modification, or denial of service. Organizations running this software should treat this as a critical priority, especially for internet-facing deployments. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies a public-facing Food Ordering System installation and accesses the /purchase.php endpoint. Using the publicly available exploit code from https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_9.md, the attacker crafts a malicious HTTP request containing SQL injection payloads in the 'custom' parameter, such as union-based or time-based blind injection techniques. The vulnerable Parameter Handler processes this input without sanitization, executing the attacker's SQL commands against the backend database to extract customer data, payment information, order histories, or administrative credentials, or to modify prices and inject malicious records. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
SQL injection in SourceCodester Food Ordering System 1.0 via the custom parameter in /purchase.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability affects PHP-based installations of this food ordering platform.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in SourceCodester Food Ordering System version 1.0, specifically in the 'custom' parameter of the /purchase.php file within the Parameter Handler component. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the database. A public proof-of-concept exploit is available on GitHub, significantly increasing exploitation risk.
RemediationAI
No official patch or updated version has been released by SourceCodester as indicated by the CVSS remediation level of 'Unavailable' (RL:X). Organizations must implement immediate compensatory controls: deploy a web application firewall (WAF) with SQL injection signatures to filter malicious requests targeting /purchase.php, apply input validation and sanitization at the application layer by modifying the Parameter Handler to use parameterized SQL queries or prepared statements for the 'custom' parameter, restrict database user privileges to minimum required permissions, and implement network segmentation to limit access to the application from untrusted networks. Consider replacing this application with a more actively maintained alternative if vendor support remains unavailable. Monitor VulDB submission https://vuldb.com/?submit.776082 and the vendor site https://www.sourcecodester.com/ for future security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects SourceCodester Food Ordering System 1.0 (CPE: cpe:2.3:a:sourcecodester:food_ordering_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing food orders. The flaw is classified as CWE-89 (SQL Injection), which occurs when user-supplied input is incorrectly sanitized before being incorporated into SQL queries. The vulnerable code in /purchase.php's Parameter Handler component fails to properly validate or escape the 'custom' parameter, allowing attackers to inject malicious SQL statements that are executed directly against the backend database. This is a classic server-side injection vulnerability common in PHP applications that construct dynamic SQL queries without using parameterized statements or prepared queries.
Know when Food Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the component Parameter Handler. The manipulation of the argument custom leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A critical SQL injection vulnerability in the Food Ordering System (CVE-2026-4839) allows unauthenticated attackers to access, modify, or delete customer and business data without authentication. With a public exploit already available, this poses immediate risk to customer confidentiality, payment information integrity, and service availability.
Deploy Web Application Firewall (WAF) with SQL injection detection rules targeting the 'custom' parameter; disable the /purchase.php endpoint until patched; implement network segmentation to restrict access to the application; enforce strict input validation and parameterized SQL queries at application level; enable enhanced database activity monitoring and alerting; require multi-factor authentication and IP whitelisting for administrative database access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in SourceCodester Systems SQL Injection
View all 2More in Food Ordering System
View allA SQL Injection vulnerability detected in Food Ordering System v1.0 allows attackers to run commands on the database by
A vulnerability was found in SourceCodester Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerabili
A vulnerability has been found in SourceCodester Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulner
SQL injection in code-projects Food Ordering System 1.0 allows high-privileged remote attackers to manipulate the itemPr
SQL injection in code-projects Food Ordering System 1.0 allows remote attackers with high-level administrative privilege
Stored cross-site scripting in CodeAstro Food Ordering System 1.0 allows authenticated admin users to inject arbitrary J
Stack-based buffer overflow in CodeAstro Food Ordering System 1.0 allows local attackers with user privileges to corrupt
Exploit-DB