PHP EUVD-2026-16682

Remote unauthenticated attacker can exploit via HTTP GET/POST to admin/manage_product.php with malicious 'id' parameter. No authentication required. SourceCodester Online Food Ordering System v1.0 default configuration affected.

While a CVSS score and vector are not available, the vulnerability exhibits high real-world risk: the attack vector is network-accessible (the admin endpoint), exploitation likely requires low or no authentication depending on access controls, publicly available exploit code substantially reduces attacker friction, and SQL injection typically yields maximum impact (confidentiality, integrity, availability of the database). The absence of CVSS and EPSS data limits formal quantification, but the presence of a GitHub-hosted public POC and the admin-tier access implied by the file path (admin/manage_product.php) suggest this is a material priority for organizations running this system. Without KEV status confirmation, we cannot confirm active mass exploitation, but the public POC eliminates reliance on zero-day sophistication.

An unauthenticated attacker discovers the admin/manage_product.php endpoint and crafts a malicious SQL injection payload in the 'id' parameter (e.g., id=1' OR '1'='1' -- ). The vulnerable application concatenates this input directly into a SQL query without escaping, allowing the attacker to extract entire database tables containing customer data, payment information, product inventory, or administrative credentials. A public POC from GitHub lowers the barrier to exploitation, enabling even unsophisticated attackers to execute this attack and exfiltrate sensitive data within minutes.