Simple Online Food Ordering System CVE-2026-76048

No special conditions are required. The vulnerable endpoint /admin/ajax.php?action=login is the standard admin login page, publicly reachable by design in any default deployment. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms exploitation requires no prior authentication, no elevated privileges, no specific non-default configuration, and no victim interaction. Factors that limit exploitation scope: (1) the target application must be deployed and network-accessible; (2) only Simple Online Food Ordering System version 1.0 is confirmed affected; (3) database impact is scoped to the application's own schema - lateral movement to the OS or other systems would require additional post-exploitation steps not described in this CVE. No feature-flag, module, or non-default setting is required to trigger the vulnerability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with E:P) reflects a low-complexity, unauthenticated, remotely exploitable flaw with a confirmed public exploit - all signals consistently point to an elevated practical risk despite the moderate aggregate score of 5.5, which is suppressed by limited VC:L/VI:L/VA:L impact metrics. No EPSS score was provided in the intelligence data, so exploitation probability relative to the broader CVE population cannot be independently quantified. No CISA KEV listing is present, indicating exploitation has not been confirmed by government intelligence sources at time of analysis. The absence of a vendor patch and the existence of a published PoC are the two most actionable risk signals: any internet-exposed instance of this application should be treated as compromised-until-mitigated. No conflicting signals were found - all available data is internally consistent.

An unauthenticated remote attacker submits a crafted HTTP POST request to /admin/ajax.php?action=login with a SQL injection payload in the Username field - for example, a boolean-based bypass such as ' OR '1'='1 or a UNION-based query to enumerate database tables. A public proof-of-concept is available via GitHub (https://github.com/Kristin5634487/cve/issues/5), meaning exploitation requires no original research. A successful attack may yield authentication bypass granting admin panel access, or full enumeration of the application database including customer orders and credentials.