Online Food Ordering System CVE-2026-90855

No authentication is required - the vulnerable endpoint /web/order.php is publicly accessible and accepts the id parameter without any access control gating. The application must be deployed and network-accessible for exploitation to occur. No special configuration, feature flag, or non-default setting is required beyond a running instance of the application. Exploitation is limited by the niche, educational-demo nature of the product, meaning real-world exposure is largely confined to developers or students who have deployed it for testing purposes. The partial impact metrics (VC:L/VI:L/VA:L) suggest the injected queries operate under a constrained database user context rather than granting full DBA access.

The CVSS 4.0 score of 5.5 (Medium) with AV:N/AC:L/AT:N/PR:N/UI:N reflects remote, unauthenticated, low-complexity exploitation requiring no user interaction - the most accessible attack profile. The E:P modifier confirms public exploit code exists, which meaningfully elevates real-world risk beyond the moderate numeric score. Impact metrics VC:L/VI:L/VA:L indicate partial rather than full database compromise, suggesting limited read/write access rather than full RCE or administrative control. There is no KEV listing and no EPSS data provided, so exploitation frequency is unknown. The product is an educational PHP demo script with minimal enterprise production footprint, substantially limiting real-world blast radius despite the permissive attack vector.

An unauthenticated remote attacker sends a crafted GET or POST request to /web/order.php?id=1 UNION SELECT ... or similar SQL injection payload. Because the id value is concatenated directly into the SQL query without sanitization, the injected clause executes against the database, potentially returning order records, user credentials, or other sensitive table contents. Public exploit code is available (E:P), meaning automated tooling such as sqlmap can be pointed at this endpoint with minimal effort.