Simple Online Food Ordering System CVE-2026-78198

The /fos/admin/ajax.php endpoint must be network-reachable - no authentication is required based on the CVSS 4.0 PR:N metric. The add_to_cart action must be enabled (it is part of the default application). No special configuration, non-default setting, or user interaction is required. Exploitation is constrained by the product's extremely limited real-world deployment footprint and its hobbyist/educational nature; organizations running production workloads on this software are the realistic target population. Local network or perimeter firewall rules blocking HTTP access to the admin path would prevent exploitation.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects low-complexity, remote, unauthenticated exploitation with no attack requirements - a straightforward risk profile. However, all three CIA impact metrics are rated Low (VC:L/VI:L/VA:L) at the vulnerable system level, and subsequent-system impact is None, capping real-world damage below what a full database compromise would entail. The E:P modifier confirms publicly available exploit code, which meaningfully raises the likelihood of opportunistic scanning and exploitation. There is no CISA KEV listing, suggesting exploitation has not yet been confirmed at scale in production environments. The product is a hobbyist-grade PHP script with negligible enterprise deployment footprint, which substantially limits the population of exposed targets - the aggregate real-world risk is low even though the individual exploitation conditions are trivial. No EPSS score was provided in the source data, so probability-of-exploitation estimates cannot be independently validated.

An unauthenticated attacker sends a crafted HTTP POST or GET request to /fos/admin/ajax.php?action=add_to_cart with a SQL payload in the pid parameter (e.g., pid=1 UNION SELECT ...). Because the parameter is interpolated directly into a SQL query without sanitization, the injected statement executes against the backend database, allowing the attacker to extract user credentials, order data, or other stored records. A public exploit demonstrating this technique is available at https://github.com/wsx138/cve/issues/4.