CodeAstro Online Catering Ordering System CVE-2026-8231

Valid authenticated user account is required to exploit this vulnerability; the CVSS vector explicitly specifies PR:L (low privilege required). The ID parameter in the /deleteorder.php endpoint must accept user-controlled input that is concatenated directly into SQL queries without sanitization or parameterization. Exploitation is possible against default configurations of the application, with no special setup or non-standard settings required. The vulnerability does NOT require user interaction (UI:N) and does NOT require administrative privileges (PR:L indicates standard user level is sufficient). Exploitation is limited by the authentication requirement; unauthenticated users cannot trigger the vulnerability. Additionally, the low-impact scope suggests the SQL injection is restricted to the application's database context and does not escalate to operating system or infrastructure compromise.

The CVSS 4.0 vector indicates PR:L (low privilege requirement), meaning only authenticated users can exploit this vulnerability, which significantly limits real-world risk compared to unauthenticated attack scenarios. The CVSS score of 2.1 reflects minimal confidentiality, integrity, and availability impact (all marked L for 'low'), suggesting the vulnerability grants restricted database access rather than full system compromise. However, the presence of publicly available exploit code (E:P) and low attack complexity (AC:L) means that once an attacker gains valid credentials, exploitation is trivial. The authentication barrier is the primary risk mitigator; for multi-tenant or public-facing deployments where user registration is open, this risk increases substantially. The limited scope (S:X/no scope change indicated) suggests the vulnerability does not affect other applications or the underlying system. This is a low-severity but easily exploitable vulnerability suitable for lateral movement or data theft scenarios where initial access is already obtained.

An authenticated user with valid credentials logs into the CodeAstro catering ordering system. Rather than deleting their own order through the intended workflow, the attacker manipulates the ID parameter in a direct request to /deleteorder.php, injecting SQL commands such as ' OR '1'='1 or a UNION-based query to extract customer payment data, user credentials, or order information from the application database. The public exploit code on GitHub provides a pre-crafted payload, enabling rapid weaponization by low-skill threat actors with access to the system.