Which versions of PHP are affected by CVE-2026-4841?

A critical SQL injection vulnerability in the Online Food Ordering System's shopping cart module allows unauthenticated attackers to remotely access, modify, or delete customer and business data.

Is there a public PoC exploit available for CVE-2026-4841?

Yes, a public proof-of-concept exploit is available for CVE-2026-4841. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4841?

Within 24 hours: Take the affected Shopping Cart Module offline or disable the 'del' parameter functionality; notify all affected customers and stakeholders. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious SQL injection patterns targeting cart.php; conduct database audit for unauthorized access or modifications. Within 30 days: Work with vendor for patch release; if unavailable, execute comprehensive code review and remediation; migrate to alternative ordering system if patch timeline exceeds 60 days.

PHP CVE-2026-4841

Q: What is the CVSS score of CVE-2026-4841?

CVE-2026-4841 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16110 MEDIUM

SQL Injection (CWE-89)

2026-03-26 VulDB

GHSA-59w9-v569-xqc3

PHP SQLi Online Food Ordering System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 04:30 euvd

EUVD-2026-16110

Analysis Generated

Mar 26, 2026 - 04:30 vuln.today

CVE Published

Mar 26, 2026 - 04:05 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Online Food Ordering System 1.0's Shopping Cart Module (cart.php) allows unauthenticated remote attackers to manipulate the del parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected PHP-based installations are at immediate risk of database compromise and data exfiltration.

Technical ContextAI

The vulnerability is classified as CWE-89 (SQL Injection) affecting code-projects Online Food Ordering System version 1.0 (CPE: cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*). The flaw resides in the form/cart.php file within the Shopping Cart Module, where user-supplied input through the 'del' parameter is directly incorporated into SQL queries without proper validation or parameterized query usage. This is a classic case of improper neutralization of special characters in SQL commands, a common vulnerability in PHP-based web applications that fail to implement prepared statements or input sanitization. The vulnerability allows attackers to inject arbitrary SQL commands through HTTP requests to manipulate the underlying database.

RemediationAI

As of the current disclosure (VulDB references: https://vuldb.com/?id.353147, https://vuldb.com/?ctiid.353147), no official vendor patch has been announced for this vulnerability, with the CVSS remediation level marked as 'Workaround'. Organizations should immediately implement input validation and parameterized queries for the 'del' parameter in form/cart.php, replacing any dynamic SQL construction with prepared statements using PDO or MySQLi with bound parameters. As an interim mitigation, deploy a Web Application Firewall (WAF) with SQL injection signatures to filter malicious requests targeting the cart.php endpoint, specifically monitoring for SQL metacharacters in the 'del' parameter. Restrict access to the Shopping Cart Module to authenticated users only if business logic permits, and implement strict input validation that whitelists only expected numeric values for the deletion parameter. Monitor application logs for suspicious SQL-related error messages or unusual database query patterns. Consider replacing this software with a maintained alternative given the lack of vendor response.