PHP EUVD-2026-16680

Remote unauthenticated attacker can exploit via HTTP GET/POST request to admin/view_product.php with malicious SQL in the 'id' parameter. No authentication, user interaction, or special configuration required. Affects SourceCodester Online Food Ordering System v1.0 default installations.

While formal CVSS and EPSS scores are absent, the risk is substantive: publicly available exploit code dramatically increases likelihood of opportunistic and targeted attacks. The attack vector is network-based (accessible remotely via HTTP/HTTPS), complexity appears low (standard SQLi payloads), and no authentication is indicated as required from the description. The absence of CVSS data prevents quantification via that framework, but the combination of POC availability, SQL injection severity, and administrative interface exposure warrants elevated priority. Under SSVC, exploitation status is 'publicly available' (not merely proof-of-concept), technical impact is high (unauthorized data access to administrative systems), and the attack is automatable. This is a genuine operational risk to any organization running this specific version, particularly if exposed to untrusted networks.

An attacker discovers the application online and accesses admin/view_product.php with a crafted SQL injection payload in the 'id' parameter (e.g., id=1' OR '1'='1). The unvalidated parameter is directly embedded in a SQL query, allowing the attacker to extract database contents, enumerate tables, or potentially execute stacked queries to modify or delete data. With publicly available POC code, this can be automated for rapid discovery and exploitation of unpatched instances across the internet.