Food Ordering System CVE-2026-76049

The /admin/ajax.php endpoint must be network-reachable from the attacker. The CVSS 4.0 vector assigns PR:N, indicating that the admin panel does not enforce authentication in the assessed configuration - a condition that, if confirmed, allows unauthenticated remote exploitation against a default installation of Simple Online Food Ordering System 1.0. If authentication IS enforced on the admin area (consistent with the /admin/ path prefix), exploitation is limited to users holding valid administrative credentials, substantially narrowing real-world risk. No non-default configuration or special feature flag is described as required beyond a reachable HTTP endpoint. Exploitation is further bounded by the product's negligible enterprise deployment footprint; opportunistic scanning for this specific application is unlikely at scale.

The CVSS 4.0 base score of 5.5 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects network-accessible, low-complexity exploitation with no authentication requirement and partial confidentiality, integrity, and availability impact. A meaningful tension exists in the data: the vulnerable endpoint lives under /admin/, which conventionally implies an authenticated administrative boundary, yet the CVSS assigns PR:N - either the admin panel does not enforce authentication (common in SourceCodester demo apps) or the CVSS assessment did not account for auth gating. This discrepancy must be verified against a live deployment before treating the vulnerability as fully unauthenticated. No EPSS score was provided, and no CISA KEV listing exists. The publicly available proof-of-concept (E:P in the CVSS 4.0 supplemental metrics) lowers exploitation complexity significantly. However, the extremely niche deployment footprint of this educational application substantially limits real-world exposure - the combination of a high CVSS exploitability profile and a near-zero enterprise footprint makes this a low operational priority for most organizations, though any internet-exposed instance is a genuine risk.

A remote attacker submits an HTTP request to /admin/ajax.php?action=save_menu with a crafted SQL payload in the ID parameter (e.g., 1 UNION SELECT user(),2,3--), which the PHP backend concatenates directly into a SQL query and executes against the database. This allows the attacker to enumerate table structures, extract stored credentials or customer order data, or modify records. A publicly available proof-of-concept on GitHub documents this technique, requiring only a standard HTTP client to replicate.