EUVD-2026-16953Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents significant real-world risk despite the moderate 7.3 CVSS score. Multiple risk signals align unfavorably: the CVSS vector confirms network-based attacks (AV:N) with low complexity (AC:L) requiring no authentication (PR:N) or user interaction (UI:N), making exploitation trivial for any attacker with network access. The exploit maturity indicator shows proof-of-concept code (E:P), confirmed by publicly available exploit code on GitHub, which dramatically reduces the skill threshold for exploitation. While EPSS data is not provided and the vulnerability is not listed in CISA KEV (indicating no confirmed active exploitation), the combination of trivial exploitability, public exploit availability, and the critical nature of SQL injection attacks creates a high-priority risk. SQL injection enables complete database compromise including data exfiltration (C:L), modification (I:L), and potential denial of service (A:L). The primary mitigating factor is the limited deployment scope of Simple Food Order System, a small open-source project with narrow enterprise adoption, reducing the overall target surface compared to widely deployed commercial software. |
| Exploit ScenarioDerived | An unauthenticated attacker scans for publicly accessible Simple Food Order System installations and identifies the /all-tickets.php endpoint. Using the publicly available GitHub exploit code, the attacker crafts a malicious HTTP request with SQL injection payloads in the Status parameter, such as "Status=1' UNION SELECT username,password,email FROM users--". The vulnerable PHP code directly incorporates this input into a SQL query without sanitization, allowing the attacker to extract the entire user database including credentials and customer information. The attacker then escalates by injecting commands to create administrative accounts, modify order records to redirect payments, or deploy a web shell for persistent access to the server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
SQL injection in Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Status parameter in /all-tickets.php. The vulnerability is trivially exploitable with low attack complexity and requires no user interaction. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis, as the Simple Food Order System project appears to be a legacy code-projects.org release with uncertain maintenance status. Organizations must implement immediate workarounds: apply input validation and parameterized queries to the Status parameter in /all-tickets.php, using prepared statements with bound parameters rather than string concatenation. Implement a web application firewall (WAF) with SQL injection signatures to filter malicious requests targeting this endpoint. Restrict access to /all-tickets.php to authenticated administrative users only through access control lists if the functionality permits. Review all database permissions to ensure the application runs with least-privilege database accounts that cannot perform administrative operations. For production environments, strongly consider migrating to actively maintained food ordering software with security support. Monitor database logs for suspicious query patterns indicating exploitation attempts. Consult the vulnerability disclosure at https://vuldb.com/vuln/353902 and the proof-of-concept at https://github.com/6Justdododo6/CVE/issues/15 to understand the specific attack vector and test defensive controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects code-projects Simple Food Order System 1.0 (CPE: cpe:2.3:a:code-projects:simple_food_order_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing food orders. The flaw is a classic SQL injection (CWE-89) in the Parameter Handler component, specifically the /all-tickets.php endpoint. The Status parameter lacks proper input validation and sanitization, allowing attackers to inject malicious SQL commands directly into backend database queries. SQL injection occurs when user-controlled input is concatenated into SQL statements without parameterized queries or escaping, enabling attackers to break out of the intended query context and execute arbitrary SQL commands. The PHP implementation appears to use direct string concatenation or inadequate filtering when processing the Status parameter, creating a direct pathway to the underlying database.
Know when Simple Food Order System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the component Parameter Handler. Performing a manipulation of the argument Status results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Simple Food Order System version 1.0 contains an unauthenticated SQL injection vulnerability in the ticket management interface that allows attackers to directly access, modify, or delete database records without authentication. Organizations using this system face immediate risk of data breach, data loss, and operational disruption, particularly if customer or order information is stored in the database.
No vendor-released patch identified at time of analysis. Interim mitigations: Deploy web application firewall (WAF) with SQL injection detection rules; implement input validation and parameterized queries if source code modifications are possible; restrict network access to /all-tickets.php to authenticated administrative IP ranges only; monitor database access logs for suspicious query patterns; consider disabling the Status parameter functionality until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Simple Food Order System
View allSimple Food Order System v1.0 has SQL injection in cancel-order.
Simple Food Order System v1.0 has SQL injection in view-ticket-admin.
Simple Food Order System v1.0 has SQL injection in view-ticket.
Simple Food Order System v1.0 has SQL injection in edit-order.
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify,
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to execute arbitrary
SQL injection in Simple Food Order System 1.0's /routers/add-item.php endpoint allows unauthenticated remote attackers t
Exploit-DB