Simple Food Ordering CVE-2026-78247

The specific vulnerable endpoint is /fos/admin/ajax.php?action=confirm_order, with the ID request parameter as the injection point. Per the CVSS 4.0 vector (PR:N, UI:N), no authentication or user interaction is required, though the /admin/ path suggests the endpoint may be intended for authenticated administrative use - whether session authentication is actually enforced in default deployments is unconfirmed and likely absent given the PR:N rating from the original researcher. Exploitation requires HTTP/HTTPS network access to TCP port 80 or 443 on the target host. No special configuration setting, non-default feature flag, or specific deployment mode is needed. Exploitation is strictly limited to systems running SourceCodester Simple Online Food Ordering System 1.0 with network exposure; air-gapped or localhost-only deployments are not exploitable via this vector.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as low-complexity, zero-prerequisite remote exploitation with E:P (proof-of-concept exists), all of which are high-risk indicators. Impact is rated Limited across Vulnerable System Confidentiality, Integrity, and Availability (VC:L/VI:L/VA:L), with no subsequent-system impact, which is consistent with database-layer access without OS-level escalation. The presence of a public exploit on GitHub (https://github.com/huliangjia/cve/issues/1) is a concrete signal that exploitation requires minimal attacker skill. However, a key tension exists: the endpoint path contains /admin/, which typically implies session-gated access; if the admin panel enforces authentication, effective exploitation would require at least PR:L. Sourcecodester demo applications frequently ship with weak or missing access controls, making PR:N plausible but not independently confirmed beyond the reporter's CVSS assignment. No EPSS data was provided, and the absence of a CISA KEV listing suggests no confirmed widespread exploitation campaigns, though this does not rule out opportunistic targeting. The narrow deployment footprint of this niche educational product limits aggregate blast radius.

A remote attacker locates an internet-exposed instance of Simple Online Food Ordering System 1.0 via search engine dorking or automated scanning, then submits a crafted HTTP GET or POST request to /fos/admin/ajax.php?action=confirm_order&ID=1 UNION SELECT ... using the publicly available proof-of-concept from GitHub. Without any authentication barrier, the injected SQL payload is executed against the backend database, allowing the attacker to enumerate table structures, extract user credentials and customer order data, or - if the database account has write permissions - modify records.