PHP EUVD-2026-14662

Remote unauthenticated attacker can exploit SQL injection in SourceCodester Online Catering Reservation 1.0 via the 'rcode' parameter in /search.php. No authentication, special configuration, or user interaction required. Default installations are vulnerable.

The CVSS score of 7.3 (High) reflects significant risk with the attack vector being network-based (AV:N), low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), enabling impact to confidentiality, integrity, and availability (C:L/I:L/A:L). The availability of a public proof-of-concept exploit dramatically elevates real-world risk, as attackers can leverage existing code without developing custom exploits. SQL injection vulnerabilities are highly automatable and frequently targeted in mass scanning campaigns. While no EPSS score or KEV listing is provided in the data, the combination of remote exploitability, no authentication requirement, public exploit code, and the prevalence of SQL injection in attacker toolkits makes this a genuine priority for organizations running the affected software. The technical impact allows database compromise, potential data exfiltration, modification of records, and possible escalation to operating system access depending on database configuration and privileges.

An unauthenticated remote attacker identifies the vulnerable Online Catering Reservation system through reconnaissance and accesses the /search.php endpoint. Using the publicly available proof-of-concept exploit, the attacker crafts a malicious HTTP request with SQL injection payloads in the 'rcode' parameter, such as UNION-based or boolean-based blind SQL injection techniques, to extract sensitive data from the database including customer information, reservation details, payment records, and administrative credentials. The attacker could further leverage database permissions to modify reservation records, delete data, or potentially execute operating system commands if the database user has elevated privileges.