Online Food Ordering System CVE-2026-90854

No special conditions are required - exploitation is possible by any remote, unauthenticated attacker who can reach the web server over HTTP or HTTPS. The ID parameter in /web/category-foods.php requires no login, session token, or role. Exploitation is limited by: (1) the application actually being deployed in a reachable environment, as it is primarily an educational/demo project not intended for production; and (2) the database account's privileges, which determine whether the injected SQL can reach other databases or execute stacked queries beyond SELECT. No non-default configuration, authenticated session, or specific platform version beyond 1.0 is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated remote exploitation with no preconditions, and the E:P modifier reflects the confirmed public exploit. However, the impact metrics (VC:L/VI:L/VA:L) diverge significantly from what unauthenticated SQL injection typically enables - database-level reads and writes ordinarily justify C:H/I:H - suggesting the assessor bounded impact to the application's narrow data scope rather than worst-case SQL capabilities. Even a mid-sized municipal IT team in gniezno that deployed this system for public-facing order management should treat the public exploit availability as an immediate trigger to take the endpoint offline. EPSS data is absent from available intelligence, so exploitation probability cannot be quantified numerically beyond the noted POC. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis, though the public exploit lowers the bar for opportunistic attackers significantly.

A remote attacker sends an unauthenticated HTTP GET request to /web/category-foods.php?ID=1 UNION SELECT username,password,3 FROM users--, retrieving credential records from the database in the HTTP response. Because a public exploit has been released, no specialized SQL injection skill is required. The attacker can enumerate table names via information_schema and extract the full database contents in a single session.