Which versions of PHP are affected by CVE-2026-5018?

Simple Food Order System version 1.0 contains an unauthenticated SQL injection vulnerability in its user registration function that allows attackers to execute arbitrary database commands without…

Is there a public PoC exploit available for CVE-2026-5018?

Yes, a public proof-of-concept exploit is available for CVE-2026-5018. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5018?

Within 24 hours: Inventory all instances of Simple Food Order System 1.0 in production and take affected systems offline or restrict network access to trusted users only. Within 7 days: Contact the vendor for security guidance and timeline for patches; evaluate alternative food ordering solutions or request a security update. Within 30 days: Implement a Web Application Firewall (WAF) rule blocking SQL injection patterns in the 'Name' parameter of register-router.php, or migrate to a patched version or alternative product when available.

PHP CVE-2026-5018

Q: What is the CVSS score of CVE-2026-5018?

CVE-2026-5018 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16955 MEDIUM

SQL Injection (CWE-89)

2026-03-28 VulDB

PHP SQLi Simple Food Order System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 02, 2026 - 20:33 vuln.today

Public exploit code

EUVD ID Assigned

Mar 28, 2026 - 22:45 euvd

EUVD-2026-16955

Analysis Generated

Mar 28, 2026 - 22:45 vuln.today

CVE Published

Mar 28, 2026 - 22:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'Name' parameter in register-router.php. The vulnerability permits unauthorized database access with confirmed publicly available exploit code (EPSS and CVSS both indicate medium-severity risk). Attack complexity is low with no user interaction required, enabling automated exploitation. No vendor-released patch identified at time of analysis, and exploitation requires no authentication (CVSS PR:N).

Technical ContextAI

This vulnerability stems from insufficient input validation in the Parameter Handler component of register-router.php, a PHP-based registration endpoint in Simple Food Order System 1.0 (CPE: cpe:2.3:a:code-projects:simple_food_order_system:*:*:*:*:*:*:*:*). The flaw is classified as CWE-89 (SQL Injection), meaning user-supplied data in the 'Name' parameter is incorporated into SQL queries without proper sanitization or parameterization. PHP applications using string concatenation or interpolation to build SQL queries are particularly vulnerable to this weakness. The affected component appears to handle user registration functionality, suggesting the injectable parameter likely feeds into INSERT or SELECT statements that create or validate user accounts. SQL injection vulnerabilities enable attackers to manipulate database queries by injecting SQL metacharacters and commands, breaking out of the intended query logic to access, modify, or delete data beyond their authorized scope.

RemediationAI

No vendor-released patch identified at time of analysis for Simple Food Order System 1.0. Organizations running this application should immediately implement parameterized queries (prepared statements) in register-router.php to sanitize the 'Name' parameter input, using PHP PDO or MySQLi prepared statement functions rather than string concatenation for SQL construction. As an interim mitigation, deploy web application firewall (WAF) rules to detect and block SQL injection patterns targeting the registration endpoint, and implement strict input validation to reject special characters and SQL keywords in the Name field. Review VulDB advisory at https://vuldb.com/vuln/353903 and the public exploit proof-of-concept at https://github.com/6Justdododo6/CVE/issues/16 to understand attack signatures. Given the apparent lack of vendor support for this educational codebase, consider migrating to a maintained alternative food ordering system if this is deployed in production environments. Conduct database audit logs review to identify any historical exploitation attempts.