EUVD-2026-42492
GHSA-cg5c-fr89-44h3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint, no auth required (PR:N), low complexity; scope unchanged with partial C/I/A impact consistent with application-level SQLi.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argument update results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
SQL injection in code-projects Online Food Order System 1.0 exposes the /edit_food_items.php endpoint to unauthenticated remote database manipulation via the update parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable without authentication or special conditions, with limited but confirmed impact across confidentiality, integrity, and availability. A public exploit has been released (E:P), making opportunistic targeting realistic despite the niche deployment footprint; no patch or vendor advisory has been identified.
Technical ContextAI
The affected application is a PHP-based web ordering system distributed by code-projects.org, a repository of academic/demo PHP projects. The vulnerability resides in /edit_food_items.php, where the update parameter is incorporated into a database query without sanitization or parameterization. The root cause is classified as CWE-74 (Injection), which encompasses SQL injection (CWE-89) - the attacker-controlled input is interpreted as SQL syntax rather than data, a classic consequence of concatenating user input directly into query strings. No prepared statements, input validation, or ORM layer appears to be in use. The CVSS 4.0 vector confirms no attack prerequisites (AT:N) and no required user interaction (UI:N), consistent with a straightforward GET or POST parameter injection against a publicly accessible admin or food-management page.
RemediationAI
No vendor-released patch or official advisory has been identified at the time of analysis. Operators running this application should immediately implement parameterized queries or prepared statements to replace any dynamic SQL construction in /edit_food_items.php - this is the definitive fix for SQL injection and has no meaningful side effects. As a compensating control, restrict access to /edit_food_items.php at the web server or firewall level to trusted IP ranges or authenticated sessions only, noting this may break intended functionality if the endpoint is publicly required. Deploying a Web Application Firewall (WAF) with SQL injection signatures can reduce exploitation risk but should not be treated as a permanent substitute for code-level remediation. Input validation (allowlisting expected parameter formats for update) provides additional defense-in-depth. Monitor database logs for anomalous query patterns indicative of exploitation. See VulDB entry https://vuldb.com/vuln/376951 and PoC at https://github.com/susususua-AI/CVE/issues/1 for technical detail to guide patching efforts.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today