Simple Online Food Ordering System CVE-2026-76998

The application must be running SourceCodester Simple Online Food Ordering System 1.0 with the /admin/ajax.php endpoint reachable over the network. Per the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N), no authentication is required and no special configuration enables the flaw - it is present in the default application state. The primary limiting factor is network reachability: if the /admin/ directory is protected by server-level authentication (HTTP basic auth, SSO reverse proxy) or restricted to internal IP ranges by firewall or .htaccess, exploitation from the internet would require bypassing those additional controls. No platform-specific, OS-level, or non-default configuration prerequisite is indicated by the available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) presents an unusually clean attack profile: network-reachable, low complexity, zero authentication, no user interaction, and no special attack requirements. The E:P maturity flag confirms a public proof-of-concept already exists, meaning exploitation capability is broadly accessible. The CVSS 4.0 score of 6.9 (Medium) reflects conservative low-impact ratings (VC:L/VI:L/VA:L) that may understate real-world risk - SQL injection against an admin endpoint typically permits full database enumeration and record manipulation, which this analyst independently rates as High C/I. The CVE does not appear in the CISA KEV catalog and no EPSS data was supplied, so widespread active exploitation is not confirmed at time of analysis. However, the zero-authentication network vector combined with a public exploit means any internet-exposed instance should be treated as imminently exploitable, regardless of the moderate composite score.

An unauthenticated remote attacker sends a crafted HTTP request to /admin/ajax.php?action=delete_category&id=1'%20OR%201=1-- or a time-based blind injection payload against the exposed admin endpoint. The unsanitized id value is embedded directly into the SQL DELETE or SELECT statement, allowing the attacker to enumerate database schema, extract credential tables, or corrupt records. A working proof-of-concept demonstrating this technique is publicly available at https://github.com/normabowie11-max/cve/issues/1.