Simple Online Food Ordering System CVE-2026-78199

The CVSS 4.0 vector PR:N/UI:N/AC:L/AT:N confirms no authentication, no user interaction, and no special attack preconditions are required. Exploitation requires only that the /fos/view_prod.php endpoint is reachable over the network - the application must be running and accessible to the attacker (e.g., internet-exposed or on a reachable internal network segment). The sole limiting factor is that the vulnerable product itself must be deployed; because this is a tutorial-grade SourceCodester application not intended for production use, inadvertent internet exposure is the primary deployment scenario enabling exploitation. No specific configuration setting, optional feature, or non-default mode is required to trigger the vulnerability - it is present in the default state of version 1.0.

The CVSS 4.0 base score of 6.9 with E:P (proof-of-concept exploit) accurately reflects moderate real-world risk in isolation, but must be contextualized heavily by prevalence. The attack vector is network (AV:N), complexity is low (AC:L), no authentication is required (PR:N), and no user interaction is needed (UI:N) - making this a trivially exploitable vulnerability for any attacker who can reach the endpoint. However, SourceCodester applications are tutorial-grade codebases not intended for production deployment; actual instances exposed on the internet represent misconfigured or naive deployments rather than a broad enterprise attack surface. No EPSS score was provided in the input data, but given the obscure product, opportunistic scanning rather than targeted exploitation is the most plausible threat model. There is no CISA KEV listing. The combination of public exploit code, zero-authentication requirements, and network accessibility makes this a clear exploit priority for the narrow population of organizations that have inadvertently deployed this application - but that population is expected to be very small.

An unauthenticated remote attacker sends an HTTP GET request to /fos/view_prod.php?id=1' UNION SELECT 1,username,password,4 FROM users-- against an internet-exposed instance. The unsanitized parameter is interpolated directly into the backend SQL query, returning credential data from the database in the HTTP response. A public proof-of-concept demonstrating this technique is referenced at https://github.com/wsx138/cve/issues/5, lowering the skill bar for exploitation to near-zero.