Food Ordering System CVE-2026-78248

The endpoint /fos/admin/ajax.php?action=save_settings must be reachable over the network. The CVSS 4.0 vector (PR:N/AC:L/AT:N/UI:N) confirms no authentication, no elevated privileges, no special attack conditions, and no user interaction are required - exploitation is viable against any default deployment of Simple Online Food Ordering System 1.0 where the web application is internet- or network-accessible. No specific feature flag, non-default configuration, or platform restriction applies. Exploitation is limited by the product's deployment scope: instances are predominantly found in student lab environments, local development setups, or demonstration servers rather than production infrastructure. The impact boundary is the application's database (VC:L/VI:L/VA:L) with no confirmed lateral movement to adjacent systems (SC:N/SI:N/SA:N).

The CVSS 4.0 base score of 6.9 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects low-complexity, unauthenticated remote exploitation with moderate and bounded database-level impact (VC:L/VI:L/VA:L, no subsequent-system impact). The E:P supplemental modifier - confirming a public PoC - meaningfully elevates practical risk beyond the base score alone, as opportunistic scanners can now trivially identify and probe exposed instances. The absence of a CISA KEV entry indicates active exploitation has not been formally confirmed, and no EPSS score was supplied, leaving probability-of-exploitation-in-the-wild unquantified; these two gaps should be verified before downgrading priority. The product's narrow deployment footprint (primarily demo and student projects rather than production infrastructure) substantially constrains real-world blast radius, but any organization that has deployed this application on a public-facing host should treat remediation as urgent given the zero-authentication requirement.

An unauthenticated attacker sends a crafted HTTP POST or GET request to /fos/admin/ajax.php?action=save_settings with a SQL payload in the Name field (e.g., ' UNION SELECT username,password,3 FROM users--), causing the backend PHP code to pass the injected query directly to the database engine. A working proof-of-concept is publicly available on GitHub (https://github.com/huliangjia/cve/issues/3), providing concrete exploitation guidance that reduces attacker skill requirements. With no authentication barrier and low complexity, automated vulnerability scanners or mass-exploitation scripts could identify and compromise exposed instances without manual effort.