Simple Online Food Ordering System CVE-2026-76996

The vulnerable endpoint /fos/admin/view_order.php must be reachable over the network - no authentication is enforced at the script level per the CVSS 4.0 PR:N rating, meaning the admin panel itself imposes no login gate. The ID parameter must be user-controllable via HTTP request, which is inherent to the application's design in version 1.0. No special configuration, feature flag, or non-default setting is required. Exploitation is limited by: network exposure of the admin panel (if placed behind a firewall or reverse proxy with IP allowlisting, remote exploitation is blocked); database user privilege scope (least-privilege DB accounts limit the attacker's post-injection reach); and the specific DBMS in use (MySQL error verbosity and FILE privilege affect technique selection). There is no user interaction or authentication requirement for the vulnerability itself.

The CVSS 4.0 score of 5.5 (AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:L/VA:L) reflects low-complexity remote exploitation with no authentication barrier and symmetric low impact across confidentiality, integrity, and availability. The E:P threat modifier confirms a public exploit exists, which operationally elevates the effective risk above what the base score alone implies. KEV listing is absent, so confirmed active exploitation is unconfirmed - however, the trivial exploitation conditions (no auth, no complexity, public PoC) mean opportunistic scanning and exploitation are highly plausible. EPSS data was not provided in the input, which is a gap in the risk picture. No conflicting signals exist between the CVSS vector and the description: both indicate unauthenticated network access to an insufficiently protected admin endpoint. The realistic blast radius depends on database user privileges at the application layer - if the DB account is scoped to least privilege, impact remains low; if over-permissioned (common in student/demo projects), full database compromise is possible.

An unauthenticated attacker sends a crafted HTTP request to /fos/admin/view_order.php?id=1' UNION SELECT ...--, injecting SQL that enumerates database tables and extracts credentials or order data. A public exploit is available at https://github.com/hubdk01/cve/issues/2, reducing the required skill level to near zero. If the database account is over-permissioned, the attacker may also write or delete records, or attempt to read file system paths via SQL file-read functions.