Online Food Ordering System CVE-2026-4841

The real-world risk is HIGH and warrants immediate attention. The CVSS 3.1 score of 7.3 reflects critical factors: network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The vulnerability has confirmed proof-of-concept exploit code publicly available at https://gist.github.com/HxH404/ed090db972001ba535202fd4f5b6a0b5, with exploit maturity rated as 'Proof-of-concept' (E:P). While the confidentiality, integrity, and availability impacts are rated Low individually, the combination of zero authentication requirements, remote exploitability, and public exploit availability creates a significant attack surface. The vulnerability is automatable, allowing attackers to scan for and exploit vulnerable instances at scale. The remediation level is marked as 'Workaround' (RL:X), indicating no official vendor patch may be available, further elevating risk. Organizations running this software should treat this as a priority given the public exploit and ease of exploitation.

An unauthenticated remote attacker crafts a malicious HTTP request to the vulnerable cart.php endpoint, injecting SQL commands through the 'del' parameter, such as: 'cart.php?del=1' OR '1'='1' UNION SELECT username,password,email FROM users--'. Because the application fails to sanitize this input, the injected SQL executes against the backend database, allowing the attacker to extract sensitive data including customer credentials, payment information, and order details. Using the publicly available proof-of-concept from https://gist.github.com/HxH404/ed090db972001ba535202fd4f5b6a0b5, attackers can automate scanning for vulnerable instances and perform mass data exfiltration or database manipulation without any authentication, leveraging the low attack complexity to compromise multiple installations rapidly.