Online Food Ordering System
Monthly
SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL commands through unsanitized input in the save_customer action's username parameter. The application fails to implement proper input validation or prepared statements, enabling attackers to manipulate database queries directly. Publicly available exploit code exists, and this vulnerability affects the PHP-based web application with no confirmed patch status at time of analysis.
SQL injection in SourceCodester Online Food Ordering System v1.0 allows authenticated attackers to execute arbitrary SQL commands via the username parameter in Actions.php (save_user action), due to improper input sanitization. Publicly available exploit code exists demonstrating this vulnerability. While CVSS and EPSS scores are unavailable, the authenticated requirement and public POC availability indicate moderate real-world risk for deployments with user account access.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
File inclusion in SourceCodester Online Food Ordering System 2.0 allows remote attackers to manipulate the 'page' parameter of /index.php to include arbitrary files via the application's include() function. Publicly available exploit code exists (referenced on GitHub), and the CVSS 7.3 score combined with no authentication or user interaction requirements (AV:N/AC:L/PR:N/UI:N) makes this trivially exploitable against any exposed deployment. The vulnerability falls under CWE-73 (External Control of File Name or Path) and primarily enables information disclosure, though depending on PHP configuration it may escalate to code execution.
Reflected cross-site scripting (XSS) in code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the cust_id parameter in /form/order.php, exploitable through user interaction (UI required). Publicly available exploit code exists; the vulnerability carries CVSS 4.3 (low severity) but poses reputational and user session hijacking risks typical of XSS attacks in e-commerce contexts.
Stored XSS in SourceCodester Online Food Ordering System v1.0 allows authenticated administrators to inject malicious JavaScript via the Category Name field in the admin panel, with payloads executing in the browsers of any user viewing the Category list. Publicly available exploit code exists; the vulnerability stems from insufficient input sanitization on a critical administrative function that affects all downstream users who access affected categories.
A security vulnerability in A weakness (CVSS 5.5). Risk factors: public PoC available.
The code-projects Online Food Ordering System versions up to 1.0 contain a stored cross-site scripting (XSS) vulnerability in the /dbfood/food.php file via the cuisines parameter, allowing authenticated attackers with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability carries a CVSS score of 2.4 (low severity) but has publicly available exploit code and confirmed documentation on GitHub, limiting its practical impact due to high privilege requirements and user interaction dependency. Remote exploitation is possible, but the attack requires an authenticated user with high-level administrative privileges and victim user interaction, substantially constraining real-world exploitation likelihood.
The Online Food Ordering System 1.0 by code-projects contains a reflected cross-site scripting (XSS) vulnerability in the Name parameter of /dbfood/contact.php that allows unauthenticated remote attackers to inject malicious scripts. The vulnerability has a publicly available proof-of-concept and affects all versions of the affected product line. While the CVSS score of 4.3 is moderate, the public availability of exploit code and minimal complexity of attack execution elevate practical risk for instances exposed to the internet.
SQL injection in the Admin Login Module of code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in /admin.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should implement network-level controls or upgrade to a patched version once available.
SQL injection in code-projects Online Food Ordering System 1.0's Shopping Cart Module (cart.php) allows unauthenticated remote attackers to manipulate the del parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected PHP-based installations are at immediate risk of database compromise and data exfiltration.
Online Food Ordering System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
We need to produce a JSON object with the specified fields. All fields must be plain text strings, not arrays or objects. We synthesize from the given data: CVE-2025-11604. Given input: CVE ID: CVE-2025-11604 Description: A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. CVSS Score: 5.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-74 EPSS Score: 0.03% (percentile 9%) POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Online Food Ordering System References: several URLs. KEV status not mentioned. So we assume not in KEV. POC publicly available. So exploitation status: "publicly available exploit code exists". Now, we need to craft the JSON. First field: product_name: "Online Ordering Food System" but must be 1-3 words. It's "Online Food Ordering System" from tags? The CPE product is "online_food_ordering_system". So product name: "Online Food Ordering System". Exactly. summary: Not copy description. Original synthesis. Must start with impact verb and product. Suggested: "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to manipulate the Status parameter in /all-orders.php, leading to unauthorized data access or modification." Mention no active exploitation detected, POC exists, low EPSS. "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to inject malicious SQL via the Status parameter in /all-orders.php, potentially reading or altering database contents. The vulnerability has a publicly available exploit, but no active exploitation has been confirmed by CISA, and EPSS estimates a low 0.03% probability of exploitation." technical_context: Underlying technology: PHP application, likely using MySQL. The vulnerability is SQL injection (CWE-89, but given CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). That's a generic injection, but SQLi is specifically CWE-89. However, the CWE provided is CWE-74. We'll mention it. Root cause: improper sanitization of user input in the Status parameter leading to SQL injection. Affected product from CPE: projectworlds online_food_ordering_system version 1.0. The issue is in /all-orders.php. "Projectworlds Online Food Ordering System 1.0 is a PHP-based web application. The vulnerability exists in the /all-orders.php script, where the 'Status' argument is directly incorporated into an SQL query without proper sanitation, falling under CWE-74. This allows injection of arbitrary SQL commands via the affected parameter." risk_assessment: Compare CVSS vector (provided as CVSS:4.0, but we need to translate to 3.1 for analysis? We can interpret: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L ... This is low impact on confidentiality, integrity, availability. So a successful attack yields limited impact. EPSS 0.03% very low. No KEV. POC exists. SSVC: exploitation is "poc" (public proof of concept), not actively exploited; automatable? Probably automatable because it's a simple URL parameter injection, but we need to check CVSS AT:N so automatable. Technical impact: low (limited C/I/A). So it's a low risk, not a priority. CVSS gives base score 5.5 (medium) but real-world risk is minimal. Mention conflicts: none. "CVSS:4.0 vector indicates network attack with low impact on confidentiality, integrity, and availability, resulting in a medium base score (5.5). However, EPSS predicts only a 0.03% chance of exploitation, placing it in the 9th percentile — well below the threshold for active concern. No CISA KEV listing exists. While a public proof-of-concept exploit lowers the barrier to exploitation, the limited technical impact and low prevalence of this niche application keep real-world risk low. The SSVC decision would lean towards 'Track' rather than 'Act', as no active exploitation has been observed and impact is limited." affected_products: "Projectworlds Online Food Ordering System version 1.0 is affected (CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0). No vendor advisory or fix information is available from the references provided; the vulnerability is reported via VulDB (id 327926)." remediation: "No vendor patch is available at this time. As a workaround, implement input validation and parameterized queries for the Status parameter in /all-orders.php to neutralize SQL injection. Additionally, restrict access to the administrative or order management interface to trusted users, and consider web application firewall (WAF) rules to block SQL injection attempts. These mitigations may require code-level changes or external filters, with potential disruption if incorrectly configured." exploit_scenario: "An attacker sends a crafted HTTP request to the /all-orders.php endpoint with a maliciously modified Status parameter, injecting SQL commands. This could extract sensitive data from the application's database or manipulate order statuses. Since a public exploit is available, an unauthenticated remote attacker with network access could easily reproduce the attack." exploitation_conditions: The CVE description says: "This manipulation of the argument Status causes sql injection." No specific authentication or configuration mentioned. CVSS vector is AV:N/PR:N/UI:N, so remote unauthenticated. But we must note that it's a specific file /all-orders.php, likely part of an admin or backend interface. Maybe it requires some access? However, per CVSS PR:N so unauthenticated. We'll state: "The vulnerable script /all-orders.php is accessible without authentication, as indicated by the CVSS vector (PR:N). No special configuration is required for exploitation; the SQL injection is triggered by direct manipulation of the Status parameter in an HTTP request. There are no limiting conditions beyond the availability of the target application online." But if the file requires some prior session? Not indicated. So I'll say: "The vulnerability is exploitable remotely without authentication, as indicated by CVSS vector parameters. No specific user interaction or non-default configuration is necessary; the Status parameter in /all-orders.php is directly injectable." attack_chain: "Send HTTP request with SQLi payload to /all-orders.php?Status=... → Database interprets injected SQL → Extract or modify order data". That's 3 steps. More detailed: "Access /all-orders.php endpoint → Inject malicious SQL into Status parameter → Database executes injected query → Attacker reads or alters data". Use "Access → Inject → Execute → Impact" four steps. I'll go with: "Send crafted request to /all-orders.php → Inject SQL payload via Status parameter → Backend database executes injected query → Sensitive data exfiltration or order manipulation". That's three steps with arrows. The field asks for 3-7 short steps separated by " → ". So I'll do: "Send HTTP request with malicious Status parameter → SQL injection into database query → Unauthorized data access or modification." confidence_notes: "Exploit code publicly available on GitHub (Duo-zhen/CVE/issues/4), confirming reproducibility. No vendor advisory or patch information; affected version confirmed by CPE and VulDB entry. No CISA KEV listing, nor independent verification of active exploitation." Also mention that authentication requirements not explicitly confirmed from description but CVSS says PR:N. prevalence: The product is a niche PHP application from Projectworlds, likely used as a learning or demonstration project, not widely deployed in enterprise. So prevalence is low. "low". Justification: "niche PHP demo system, limited real-world deployments". So "low". prevalence_basis: "projectworlds' demo/tutorial-level application, not enterprise-scale" assessed_cvss_vector: My own CVSS 3.1 vector. Given AV:N, AC:L, PR:N, UI:N, S:U (no scope change), Confidentiality Low (limited read), Integrity Low (modify maybe), Availability Low (maybe no DoS but limited). So: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's base score 6.3? Wait actually C:L/I:L/A:L yields score 7.1? Let's compute: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: (N, L, N, N, U) using formula: Impact subscore (ISS) = 1 - (1-C)*(1-I)*(1-A) = 1 - 0.9*0.9*0.9 = 1 - 0.729 = 0.271. Impact = 6.42 * ISS = 6.42 * 0.271 = 1.74. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85? Wait formula: Exploitability = 8.22 * AttackVector * AttackComplexity * PrivilegesRequired * UserInteraction. For AV:N=0.85, AC:L=0.77, PR:N=0.85, UI:N=0.85 => Exploitability = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * 0.4727 ≈ 3.886. Base Score = if Impact subscore <=0, 0; else roundup(min(Impact + Exploitability, 10))? Actually if Scope Unchanged, Base Score = roundup(min(Impact + Exploitability, 10)). 1.74 + 3.886 = 5.626, round up 5.7? Wait rounding rules: round up to one decimal: 5.626 -> 5.7. That's medium. But the provided CVSS 4.0 score is 5.5. So 5.7 is close. However, a more accurate assessment: The given CVSS:4.0 has VC:L/VI:L/VA:L, so impacted components vulnerable system confidentiality, integrity, availability all low. That suggests the SQL injection could read some data, modify some data, and cause limited availability impact (maybe denial of service). So C:L/I:L/A:L is appropriate. So I'll use that vector. I'll justify: "Network-accessible, low complexity, no privileges or user interaction; limited impact on all three CIA dimensions." assessed_cvss_rationale: "Network-accessible, no auth or user interaction required; low impact on confidentiality, integrity, and availability." assessed_cvss40_vector: The provided vector is already CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N . I can use that exact vector as my assessment, as it is consistent. But the instruction says "Your OWN independent CVSS 4.0 base vector" – I can reuse the same one if I agree. I'll keep it because it accurately reflects the vulnerability: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So I'll output that. assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale: "Matches the provided vector, reflecting remote unauthenticated access with limited impact on the vulnerable system." Now, put together all fields. All must be strings, no arrays. Let's craft each field accurately. product_name: "Online Food Ordering System" summary:
A vulnerability was found in projectworlds Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Campcodes Online Food Ordering System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical.php of the component All Users Page. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in itsourcecode Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in itsourcecode Online Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL commands through unsanitized input in the save_customer action's username parameter. The application fails to implement proper input validation or prepared statements, enabling attackers to manipulate database queries directly. Publicly available exploit code exists, and this vulnerability affects the PHP-based web application with no confirmed patch status at time of analysis.
SQL injection in SourceCodester Online Food Ordering System v1.0 allows authenticated attackers to execute arbitrary SQL commands via the username parameter in Actions.php (save_user action), due to improper input sanitization. Publicly available exploit code exists demonstrating this vulnerability. While CVSS and EPSS scores are unavailable, the authenticated requirement and public POC availability indicate moderate real-world risk for deployments with user account access.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
File inclusion in SourceCodester Online Food Ordering System 2.0 allows remote attackers to manipulate the 'page' parameter of /index.php to include arbitrary files via the application's include() function. Publicly available exploit code exists (referenced on GitHub), and the CVSS 7.3 score combined with no authentication or user interaction requirements (AV:N/AC:L/PR:N/UI:N) makes this trivially exploitable against any exposed deployment. The vulnerability falls under CWE-73 (External Control of File Name or Path) and primarily enables information disclosure, though depending on PHP configuration it may escalate to code execution.
Reflected cross-site scripting (XSS) in code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the cust_id parameter in /form/order.php, exploitable through user interaction (UI required). Publicly available exploit code exists; the vulnerability carries CVSS 4.3 (low severity) but poses reputational and user session hijacking risks typical of XSS attacks in e-commerce contexts.
Stored XSS in SourceCodester Online Food Ordering System v1.0 allows authenticated administrators to inject malicious JavaScript via the Category Name field in the admin panel, with payloads executing in the browsers of any user viewing the Category list. Publicly available exploit code exists; the vulnerability stems from insufficient input sanitization on a critical administrative function that affects all downstream users who access affected categories.
A security vulnerability in A weakness (CVSS 5.5). Risk factors: public PoC available.
The code-projects Online Food Ordering System versions up to 1.0 contain a stored cross-site scripting (XSS) vulnerability in the /dbfood/food.php file via the cuisines parameter, allowing authenticated attackers with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability carries a CVSS score of 2.4 (low severity) but has publicly available exploit code and confirmed documentation on GitHub, limiting its practical impact due to high privilege requirements and user interaction dependency. Remote exploitation is possible, but the attack requires an authenticated user with high-level administrative privileges and victim user interaction, substantially constraining real-world exploitation likelihood.
The Online Food Ordering System 1.0 by code-projects contains a reflected cross-site scripting (XSS) vulnerability in the Name parameter of /dbfood/contact.php that allows unauthenticated remote attackers to inject malicious scripts. The vulnerability has a publicly available proof-of-concept and affects all versions of the affected product line. While the CVSS score of 4.3 is moderate, the public availability of exploit code and minimal complexity of attack execution elevate practical risk for instances exposed to the internet.
SQL injection in the Admin Login Module of code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in /admin.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should implement network-level controls or upgrade to a patched version once available.
SQL injection in code-projects Online Food Ordering System 1.0's Shopping Cart Module (cart.php) allows unauthenticated remote attackers to manipulate the del parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected PHP-based installations are at immediate risk of database compromise and data exfiltration.
Online Food Ordering System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
We need to produce a JSON object with the specified fields. All fields must be plain text strings, not arrays or objects. We synthesize from the given data: CVE-2025-11604. Given input: CVE ID: CVE-2025-11604 Description: A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. CVSS Score: 5.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-74 EPSS Score: 0.03% (percentile 9%) POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Online Food Ordering System References: several URLs. KEV status not mentioned. So we assume not in KEV. POC publicly available. So exploitation status: "publicly available exploit code exists". Now, we need to craft the JSON. First field: product_name: "Online Ordering Food System" but must be 1-3 words. It's "Online Food Ordering System" from tags? The CPE product is "online_food_ordering_system". So product name: "Online Food Ordering System". Exactly. summary: Not copy description. Original synthesis. Must start with impact verb and product. Suggested: "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to manipulate the Status parameter in /all-orders.php, leading to unauthorized data access or modification." Mention no active exploitation detected, POC exists, low EPSS. "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to inject malicious SQL via the Status parameter in /all-orders.php, potentially reading or altering database contents. The vulnerability has a publicly available exploit, but no active exploitation has been confirmed by CISA, and EPSS estimates a low 0.03% probability of exploitation." technical_context: Underlying technology: PHP application, likely using MySQL. The vulnerability is SQL injection (CWE-89, but given CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). That's a generic injection, but SQLi is specifically CWE-89. However, the CWE provided is CWE-74. We'll mention it. Root cause: improper sanitization of user input in the Status parameter leading to SQL injection. Affected product from CPE: projectworlds online_food_ordering_system version 1.0. The issue is in /all-orders.php. "Projectworlds Online Food Ordering System 1.0 is a PHP-based web application. The vulnerability exists in the /all-orders.php script, where the 'Status' argument is directly incorporated into an SQL query without proper sanitation, falling under CWE-74. This allows injection of arbitrary SQL commands via the affected parameter." risk_assessment: Compare CVSS vector (provided as CVSS:4.0, but we need to translate to 3.1 for analysis? We can interpret: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L ... This is low impact on confidentiality, integrity, availability. So a successful attack yields limited impact. EPSS 0.03% very low. No KEV. POC exists. SSVC: exploitation is "poc" (public proof of concept), not actively exploited; automatable? Probably automatable because it's a simple URL parameter injection, but we need to check CVSS AT:N so automatable. Technical impact: low (limited C/I/A). So it's a low risk, not a priority. CVSS gives base score 5.5 (medium) but real-world risk is minimal. Mention conflicts: none. "CVSS:4.0 vector indicates network attack with low impact on confidentiality, integrity, and availability, resulting in a medium base score (5.5). However, EPSS predicts only a 0.03% chance of exploitation, placing it in the 9th percentile — well below the threshold for active concern. No CISA KEV listing exists. While a public proof-of-concept exploit lowers the barrier to exploitation, the limited technical impact and low prevalence of this niche application keep real-world risk low. The SSVC decision would lean towards 'Track' rather than 'Act', as no active exploitation has been observed and impact is limited." affected_products: "Projectworlds Online Food Ordering System version 1.0 is affected (CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0). No vendor advisory or fix information is available from the references provided; the vulnerability is reported via VulDB (id 327926)." remediation: "No vendor patch is available at this time. As a workaround, implement input validation and parameterized queries for the Status parameter in /all-orders.php to neutralize SQL injection. Additionally, restrict access to the administrative or order management interface to trusted users, and consider web application firewall (WAF) rules to block SQL injection attempts. These mitigations may require code-level changes or external filters, with potential disruption if incorrectly configured." exploit_scenario: "An attacker sends a crafted HTTP request to the /all-orders.php endpoint with a maliciously modified Status parameter, injecting SQL commands. This could extract sensitive data from the application's database or manipulate order statuses. Since a public exploit is available, an unauthenticated remote attacker with network access could easily reproduce the attack." exploitation_conditions: The CVE description says: "This manipulation of the argument Status causes sql injection." No specific authentication or configuration mentioned. CVSS vector is AV:N/PR:N/UI:N, so remote unauthenticated. But we must note that it's a specific file /all-orders.php, likely part of an admin or backend interface. Maybe it requires some access? However, per CVSS PR:N so unauthenticated. We'll state: "The vulnerable script /all-orders.php is accessible without authentication, as indicated by the CVSS vector (PR:N). No special configuration is required for exploitation; the SQL injection is triggered by direct manipulation of the Status parameter in an HTTP request. There are no limiting conditions beyond the availability of the target application online." But if the file requires some prior session? Not indicated. So I'll say: "The vulnerability is exploitable remotely without authentication, as indicated by CVSS vector parameters. No specific user interaction or non-default configuration is necessary; the Status parameter in /all-orders.php is directly injectable." attack_chain: "Send HTTP request with SQLi payload to /all-orders.php?Status=... → Database interprets injected SQL → Extract or modify order data". That's 3 steps. More detailed: "Access /all-orders.php endpoint → Inject malicious SQL into Status parameter → Database executes injected query → Attacker reads or alters data". Use "Access → Inject → Execute → Impact" four steps. I'll go with: "Send crafted request to /all-orders.php → Inject SQL payload via Status parameter → Backend database executes injected query → Sensitive data exfiltration or order manipulation". That's three steps with arrows. The field asks for 3-7 short steps separated by " → ". So I'll do: "Send HTTP request with malicious Status parameter → SQL injection into database query → Unauthorized data access or modification." confidence_notes: "Exploit code publicly available on GitHub (Duo-zhen/CVE/issues/4), confirming reproducibility. No vendor advisory or patch information; affected version confirmed by CPE and VulDB entry. No CISA KEV listing, nor independent verification of active exploitation." Also mention that authentication requirements not explicitly confirmed from description but CVSS says PR:N. prevalence: The product is a niche PHP application from Projectworlds, likely used as a learning or demonstration project, not widely deployed in enterprise. So prevalence is low. "low". Justification: "niche PHP demo system, limited real-world deployments". So "low". prevalence_basis: "projectworlds' demo/tutorial-level application, not enterprise-scale" assessed_cvss_vector: My own CVSS 3.1 vector. Given AV:N, AC:L, PR:N, UI:N, S:U (no scope change), Confidentiality Low (limited read), Integrity Low (modify maybe), Availability Low (maybe no DoS but limited). So: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's base score 6.3? Wait actually C:L/I:L/A:L yields score 7.1? Let's compute: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: (N, L, N, N, U) using formula: Impact subscore (ISS) = 1 - (1-C)*(1-I)*(1-A) = 1 - 0.9*0.9*0.9 = 1 - 0.729 = 0.271. Impact = 6.42 * ISS = 6.42 * 0.271 = 1.74. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85? Wait formula: Exploitability = 8.22 * AttackVector * AttackComplexity * PrivilegesRequired * UserInteraction. For AV:N=0.85, AC:L=0.77, PR:N=0.85, UI:N=0.85 => Exploitability = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * 0.4727 ≈ 3.886. Base Score = if Impact subscore <=0, 0; else roundup(min(Impact + Exploitability, 10))? Actually if Scope Unchanged, Base Score = roundup(min(Impact + Exploitability, 10)). 1.74 + 3.886 = 5.626, round up 5.7? Wait rounding rules: round up to one decimal: 5.626 -> 5.7. That's medium. But the provided CVSS 4.0 score is 5.5. So 5.7 is close. However, a more accurate assessment: The given CVSS:4.0 has VC:L/VI:L/VA:L, so impacted components vulnerable system confidentiality, integrity, availability all low. That suggests the SQL injection could read some data, modify some data, and cause limited availability impact (maybe denial of service). So C:L/I:L/A:L is appropriate. So I'll use that vector. I'll justify: "Network-accessible, low complexity, no privileges or user interaction; limited impact on all three CIA dimensions." assessed_cvss_rationale: "Network-accessible, no auth or user interaction required; low impact on confidentiality, integrity, and availability." assessed_cvss40_vector: The provided vector is already CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N . I can use that exact vector as my assessment, as it is consistent. But the instruction says "Your OWN independent CVSS 4.0 base vector" – I can reuse the same one if I agree. I'll keep it because it accurately reflects the vulnerability: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So I'll output that. assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale: "Matches the provided vector, reflecting remote unauthenticated access with limited impact on the vulnerable system." Now, put together all fields. All must be strings, no arrays. Let's craft each field accurately. product_name: "Online Food Ordering System" summary:
A vulnerability was found in projectworlds Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Campcodes Online Food Ordering System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical.php of the component All Users Page. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in itsourcecode Online Food Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in itsourcecode Online Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Online Food Ordering System up to 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Online Food Ordering System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated low severity (CVSS 2.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Online Food Ordering System 2.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.