Which versions of PHP are affected by CVE-2026-4839?

A critical SQL injection vulnerability in the Food Ordering System (CVE-2026-4839) allows unauthenticated attackers to access, modify, or delete customer and business data without authentication.

Is there a public PoC exploit available for CVE-2026-4839?

Yes, a public proof-of-concept exploit is available for CVE-2026-4839. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4839?

Within 24 hours: Immediately disable the /purchase.php endpoint or restrict access via network controls; audit logs for exploitation attempts; notify stakeholders of potential exposure. Within 7 days: Deploy WAF rules to block SQL injection patterns in the 'custom' parameter; conduct database audit for unauthorized access or modifications; implement network segmentation to isolate the affected system. Within 30 days: Evaluate alternative ordering systems or vendor security updates; perform forensic analysis if compromise suspected; implement input validation and parameterized queries as interim code-level mitigations; establish vendor communication for patch timeline.

PHP CVE-2026-4839

Q: What is the CVSS score of CVE-2026-4839?

CVE-2026-4839 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16085 MEDIUM

SQL Injection (CWE-89)

2026-03-26 VulDB

GHSA-2w66-j4vc-q66r

PHP SQLi Food Ordering System Sourcecodester

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 03:45 euvd

EUVD-2026-16085

Analysis Generated

Mar 26, 2026 - 03:45 vuln.today

CVE Published

Mar 26, 2026 - 03:14 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the component Parameter Handler. The manipulation of the argument custom leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SourceCodester Food Ordering System 1.0 via the custom parameter in /purchase.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability affects PHP-based installations of this food ordering platform.

Technical ContextAI

This vulnerability affects SourceCodester Food Ordering System 1.0 (CPE: cpe:2.3:a:sourcecodester:food_ordering_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing food orders. The flaw is classified as CWE-89 (SQL Injection), which occurs when user-supplied input is incorrectly sanitized before being incorporated into SQL queries. The vulnerable code in /purchase.php's Parameter Handler component fails to properly validate or escape the 'custom' parameter, allowing attackers to inject malicious SQL statements that are executed directly against the backend database. This is a classic server-side injection vulnerability common in PHP applications that construct dynamic SQL queries without using parameterized statements or prepared queries.

RemediationAI

No official patch or updated version has been released by SourceCodester as indicated by the CVSS remediation level of 'Unavailable' (RL:X). Organizations must implement immediate compensatory controls: deploy a web application firewall (WAF) with SQL injection signatures to filter malicious requests targeting /purchase.php, apply input validation and sanitization at the application layer by modifying the Parameter Handler to use parameterized SQL queries or prepared statements for the 'custom' parameter, restrict database user privileges to minimum required permissions, and implement network segmentation to limit access to the application from untrusted networks. Consider replacing this application with a more actively maintained alternative if vendor support remains unavailable. Monitor VulDB submission https://vuldb.com/?submit.776082 and the vendor site https://www.sourcecodester.com/ for future security updates.