Simple Food Order System CVE-2026-5018

Real-world risk is moderate with a clear exploitation pathway. The CVSS 7.3 score reflects network-based attack vector (AV:N) requiring no authentication (PR:N), low complexity (AC:L), and no user interaction (UI:N), though impact is limited to low confidentiality, integrity, and availability (C:L/I:L/A:L). Publicly available exploit code exists (confirmed via GitHub PoC reference), lowering the skill barrier for opportunistic attackers, though no CISA KEV listing indicates this is not confirmed actively exploited in significant campaigns. The CVSS temporal metrics show Exploit Proof-of-Concept (E:P) is available. SSVC considerations: exploitation is publicly demonstrated, attack is highly automatable given the network vector and no-auth requirement, and technical impact allows partial data exposure and modification. However, Simple Food Order System 1.0 appears to be a code-projects.org demonstration/educational application with limited production deployment footprint, significantly constraining real-world exposure. This is a credible risk for any internet-facing instances but not a widespread enterprise threat. Organizations running this specific version should prioritize remediation, while broader industry risk remains low due to limited adoption.

An unauthenticated attacker identifies a Simple Food Order System 1.0 instance exposed to the internet and navigates to the registration page. Using the publicly available GitHub proof-of-concept exploit, the attacker crafts a malicious payload in the Name field (e.g., "admin' OR '1'='1' --" or UNION-based injection) and submits the registration form to register-router.php. The vulnerable Parameter Handler processes the unsanitized input directly into a SQL query, allowing the attacker to bypass authentication logic, extract user credentials from the database, or insert a privileged administrative account. With low attack complexity and no authentication barrier, automated scanning tools can identify and exploit this vulnerability at scale against multiple targets running this PHP application.