EUVD-2026-12588Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 7.3 (High) reflects a network-accessible attack requiring low complexity with no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), though impact is limited across all CIA triad components (C:L/I:L/A:L). The availability of a public proof-of-concept exploit on GitHub (https://github.com/6Justdododo6/CVE/issues/14) significantly elevates real-world risk by enabling script-kiddie level attacks. While EPSS and KEV status data are not provided, the combination of public exploit availability, remote exploitability, and no authentication requirement makes this a genuine priority for organizations running this software. However, the limited deployment scope of code-projects applications (typically small-scale implementations) may reduce overall internet-wide impact compared to enterprise software vulnerabilities. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a Simple Food Order System installation and sends a crafted HTTP request to /routers/add-item.php with a malicious SQL payload in the 'price' parameter, such as '1' OR '1'='1' UNION SELECT username,password FROM users--'. Because the application fails to sanitize this input, the injected SQL executes, allowing the attacker to extract sensitive data including administrator credentials, modify menu prices to disrupt business operations, or delete order records. With the public proof-of-concept available on GitHub, attackers can automate scanning and exploitation across internet-facing instances with minimal technical skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
SQL injection in Simple Food Order System 1.0's /routers/add-item.php endpoint allows unauthenticated remote attackers to manipulate the price parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and could lead to unauthorized data access, modification, or deletion.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in the Simple Food Order System version 1.0, specifically in the /routers/add-item.php file where the 'price' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the database. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation.
RemediationAI
No official patch or updated version from code-projects has been identified in available references. Organizations should immediately discontinue use of Simple Food Order System 1.0 in production environments and migrate to a maintained, secure alternative for food ordering functionality. If continued use is unavoidable, implement input validation and parameterized queries for the /routers/add-item.php file, specifically sanitizing the 'price' parameter using prepared statements or stored procedures. Deploy a web application firewall (WAF) with SQL injection detection rules to block exploitation attempts targeting this endpoint. Restrict network access to the application to trusted IP ranges and implement database-level privilege separation to limit damage from successful exploitation. Monitor VulDB advisories at https://vuldb.com/?id.351363 and https://vuldb.com/?ctiid.351363 for any vendor response or community patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects code-projects Simple Food Order System 1.0 (CPE: cpe:2.3:a:code-projects:simple_food_order_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing food orders. The root cause is CWE-89 (SQL Injection), where user-supplied input in the 'price' argument of the add-item.php router is incorporated into SQL queries without proper validation or parameterized query usage. This allows attackers to inject malicious SQL statements that the database executes with the application's privileges, potentially enabling unauthorized data access, modification, or deletion.
Know when Simple Food Order System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/add-item.php. Such manipulation of the argument price leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Executive ViewAI
A publicly exploited SQL injection vulnerability in Simple Food Order System 1.0 allows remote attackers to manipulate database queries through the price parameter, potentially exposing or modifying customer and order data. Organizations running this application face immediate risk of data breach, system compromise, and operational disruption without vendor remediation.
Deploy WAF rules to filter SQL injection patterns in the price parameter; implement input validation and parameterized queries at the application layer if source code access exists; restrict network access to /routers/add-item.php via IP allowlisting; disable the affected food ordering feature if business operations permit; monitor database logs for suspicious queries; implement database activity monitoring and alerting.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Simple Food Order System
View allSimple Food Order System v1.0 has SQL injection in cancel-order.
Simple Food Order System v1.0 has SQL injection in view-ticket-admin.
Simple Food Order System v1.0 has SQL injection in view-ticket.
Simple Food Order System v1.0 has SQL injection in edit-order.
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify,
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete data
Exploit-DB