EUVD-2026-13563Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | The CVSS 3.1 score of 4.7 reflects a medium-impact vulnerability with low attack complexity (AC:L) and network accessibility (AV:N), but mitigated by high privilege requirements (PR:H) and limited scope (S:U). The CVSS vector indicates low confidentiality, integrity, and availability impact (C:L, I:L, A:L), suggesting restricted data exposure rather than catastrophic breach. However, the availability of a public exploit combined with the administrative privilege requirement creates a moderate real-world risk: while external attackers cannot directly exploit this without compromising an admin account first, insider threats or multi-stage attacks targeting administrators pose credible danger. The limited technical impact (low CIA impact) suggests this is not a critical infrastructure threat, but for e-commerce platforms handling customer data and payment information, even limited database manipulation carries business and compliance risk. Organizations using this system should prioritize patching but this does not warrant critical/emergency classification. |
| Exploit ScenarioDerived | An authenticated administrator account (either legitimately compromised via phishing or credential theft, or a malicious insider) navigates to the admin menu editing functionality and injects a SQL payload into the product_name field (e.g., product_name='; DROP TABLE orders; --). Because the application concatenates this input directly into a SQL query without escaping or parameterization, the attacker executes arbitrary SQL commands against the backend database, potentially exfiltrating customer orders, payment data, or modifying menu items and pricing. The public availability of a proof-of-concept exploit accelerates attack timeline for threat actors who may have already compromised lower-privileged accounts and are attempting privilege escalation or lateral movement within the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers with high-level privileges to manipulate the product_name parameter in /admin/admin_edit_menu_action.php, potentially exposing or modifying sensitive database information. Public exploit code for this vulnerability exists, though no patch is currently available.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in itsourcecode Online Frozen Foods Ordering System version 1.0 within the /admin/admin_edit_menu_action.php file, where the product_name parameter is not properly sanitized. An authenticated administrator with high privileges can exploit this remotely to manipulate SQL queries, potentially allowing unauthorized access to or modification of database contents. A public proof-of-concept exploit is available, increasing the likelihood of real-world exploitation.
RemediationAI
Immediately upgrade to the latest available version of itsourcecode Online Frozen Foods Ordering System if a patch has been released by the vendor; check https://itsourcecode.com/ and the GitHub repository at https://github.com/sjkdhl/public/issues/4 for patch availability. Until a patch is available, implement input validation and parameterized queries (prepared statements) in the /admin/admin_edit_menu_action.php file to sanitize the product_name parameter before any SQL database operation. Additionally, restrict administrative access via network segmentation, enforce strong authentication on admin accounts, apply a Web Application Firewall (WAF) rule to detect SQL injection patterns in the product_name parameter, and enable comprehensive logging and monitoring of admin panel activities to detect exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or 'Injection') manifesting as SQL injection. The affected application is a PHP-based web ordering system for frozen foods that fails to properly parameterize or escape user input before incorporating it into SQL queries. The vulnerable endpoint /admin/admin_edit_menu_action.php accepts the product_name parameter without adequate input validation or prepared statement usage, allowing attackers to break out of intended SQL context and execute arbitrary SQL commands. This is a classic second-order injection scenario where admin functionality is compromised.
Know when Online Frozen Foods Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_edit_menu_action.php. Such manipulation of the argument product_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
Executive ViewAI
Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4469, a injection vulnerability rated CVSS 4.7. Exploitation could allow attackers to execute code or inject malicious input. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in itsourcecode Online Frozen Foods System Injection
View all 4Online Frozen Foods Ordering System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database que
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables r
Exploit-DB