Simple Food Order System EUVD-2026-16959

Real-world risk is moderate-to-high despite the 7.3 CVSS score. The CVSS vector indicates network-accessible exploitation (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), making this trivially exploitable by unauthenticated attackers. The impact scope is limited to confidentiality, integrity, and availability at Low levels (C:L/I:L/A:L), suggesting partial database compromise rather than full system takeover. Critically, a publicly available proof-of-concept exploit exists (GitHub issue #17 in the 6Justdododo6/CVE repository), significantly lowering the barrier to exploitation. However, CISA KEV status is not indicated, suggesting no confirmed active exploitation campaigns at time of analysis. EPSS data is not provided, but the combination of public exploit, unauthenticated network access, and simple attack complexity indicates high likelihood of opportunistic exploitation. The primary limiting factor is the small attack surface: this affects a niche open-source project with limited deployment footprint compared to enterprise software. Organizations running this specific application face immediate risk; broader internet exposure is constrained by the product's narrow user base.

An unauthenticated remote attacker identifies a publicly accessible Simple Food Order System installation and navigates to the all-orders.php endpoint. Using the publicly available GitHub proof-of-concept, the attacker crafts a malicious HTTP request injecting SQL commands into the Status parameter, such as Status=' UNION SELECT username,password,email FROM users--. The vulnerable PHP code concatenates this unsanitized input directly into a SQL query, causing the database to execute the attacker's injected commands instead of the intended query. The attacker extracts administrative credentials, customer data, or order information from the database (confidentiality impact), modifies order statuses or pricing (integrity impact), or executes DROP TABLE commands to disrupt operations (availability impact). Exploitation requires no authentication and can be automated using the published exploit code, enabling mass scanning and compromise of internet-facing installations.