Simple Online Food Ordering System EUVD-2026-63394

The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access to the admin panel is required - unauthenticated exploitation is not possible. The target endpoint /admin/ajax.php with the action=save_category parameter must be network-reachable from the attacker. No special non-default configuration is required beyond a standard installation with the admin panel exposed. Limiting factors: the attacker must first acquire valid admin credentials (via credential stuffing, brute force, or phishing); the product is typically deployed in small or educational environments and is rarely internet-facing; and exploitation impact is constrained to the application's own database unless the database user has FILE privilege, which is non-default on most managed hosting environments.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/E:P) indicates a network-reachable, low-complexity flaw requiring low-privilege authentication, with uniform low impact across confidentiality, integrity, and availability. The E:P modifier confirms a publicly available PoC, elevating the practical risk above the 5.3 base score alone. No EPSS data was provided and the vulnerability is absent from CISA KEV, indicating no confirmed mass exploitation. However, SQL injection vulnerabilities are routinely underestimated by base metrics: UNION-based or stacked-query techniques may permit database credential extraction or file system access depending on MySQL/MariaDB privilege configuration, potentially escalating impact beyond the low-impact ratings assessed. The authentication requirement (PR:L) is the primary limiting factor - this cannot be weaponized by unauthenticated internet scanners. Given the product's typical educational/small-business deployment profile, real-world blast radius is narrow despite the public PoC.

An attacker who has obtained or guessed low-privilege admin credentials logs into the food ordering system's admin panel, then sends a crafted HTTP POST request to /admin/ajax.php?action=save_category with a SQL injection payload (e.g., ID=1 UNION SELECT username,password,3 FROM admin--) in the ID parameter. The backend PHP code passes this unsanitized value directly into a SQL query, returning database row data - including admin credentials - in the response. The public PoC at https://github.com/hubdk01/cve/issues/3 provides a working demonstration of this technique.