Is there a public PoC exploit available for CVE-2026-8231?

Yes, a public proof-of-concept exploit is available for CVE-2026-8231. Prioritise patching immediately. EPSS: 0.0%.

CodeAstro Online Catering Ordering System CVE-2026-8231

Q: What is the CVSS score of CVE-2026-8231?

CVE-2026-8231 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28982 LOW

SQL Injection (CWE-89)

2026-05-10 VulDB

GHSA-9qgj-98p7-542m

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 06:30 vuln.today

Severity Changed

May 10, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

May 10, 2026 - 06:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 10, 2026 - 05:00 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in CodeAstro Online Catering Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /deleteorder.php, with publicly available exploit code disclosed. Despite a low CVSS score of 2.1 due to authentication requirements and limited impact scope, the vulnerability enables data exfiltration or manipulation within the application's database with minimal attack complexity.

Technical ContextAI

The vulnerability exists in the /deleteorder.php endpoint of the PHP-based catering ordering system. The application fails to properly sanitize or parameterize the ID parameter before using it in SQL query construction, creating a classic SQL injection flaw (CWE-89). The attack vector is network-based with low attack complexity, indicating the injection point is straightforward to exploit once authenticated. The PHP backend's direct concatenation of user input into SQL statements without prepared statements or input validation is the root cause.

RemediationAI

Upgrade to a patched version of CodeAstro Online Catering Ordering System if available from the vendor at https://codeastro.com/. If no patched version is available, implement the following compensating controls: (1) Use parameterized queries or prepared statements for all database interactions in /deleteorder.php, replacing direct string concatenation with bound parameters; (2) Apply strict input validation and whitelisting for the ID parameter, accepting only alphanumeric values matching the known format of order identifiers; (3) Restrict access to /deleteorder.php to authorized administrators only via role-based access control, reducing the attack surface from any authenticated user to administrative users; (4) Deploy a Web Application Firewall with SQL injection detection rules to block payloads containing SQL keywords and escape sequences; (5) Enforce database account privileges so the application uses a database user with minimal permissions, limiting damage from successful injection attacks. Monitor database logs for suspicious SQL patterns.