Food Ordering System CVE-2026-76050

The CVSS 4.0 vector specifies AV:N/PR:N/UI:N, indicating no authentication or user interaction is required for exploitation from a network-accessible instance. The specific required condition is that the /admin/ajax.php script is reachable over the network and that the action=delete_menu code path passes the id parameter to a SQL query without sanitization. A critical deployment-dependent limiting factor is whether the /admin/ directory is protected by server-level authentication (e.g., HTTP Basic Auth, session enforcement, or IP restriction) - deployments with such controls would require attacker authentication before reaching the vulnerable parameter. Exploitation is further limited to environments running SourceCodester Simple Online Food Ordering System 1.0 specifically; no other products share this CPE.

The CVSS 4.0 score of 5.5 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects a low-complexity, network-exploitable, unauthenticated attack with limited-to-moderate impact across confidentiality, integrity, and availability. The E:P exploit maturity modifier confirms publicly available exploit code, which is a material risk amplifier beyond the base score. This CVE does not appear in CISA KEV at time of analysis, and no EPSS value was provided in the source data. The critical inconsistency worth flagging is the PR:N rating against an /admin/ path - many SourceCodester applications ship without server-level access controls on admin directories, making PR:N plausible, but any deployment that has properly restricted /admin/ to authenticated sessions would significantly reduce real-world risk. Even a mid-sized municipal IT team in sanok running this system on a public-facing server should treat this as urgent, given the trivial exploit path and public POC. Real-world impact is constrained by the product's niche educational footprint, but any exposed instance offers an attacker immediate, low-effort database access.

An attacker identifies a publicly accessible instance of Simple Online Food Ordering System 1.0 and sends a crafted HTTP GET or POST request to /admin/ajax.php?action=delete_menu&id=1 UNION SELECT 1,username,password,4 FROM users--, extracting credential data from the database without any authentication. A public proof-of-concept is available on GitHub (https://github.com/jackkoz0512/cve/issues/1), enabling exploitation by low-skill attackers using standard SQL injection tooling such as sqlmap.