Simple Online Food Ordering System

Unauthenticated SQL injection in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to manipulate backend database queries via the unsanitized `Name` parameter in `/fos/admin/ajax.php?action=save_settings`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions required. A public proof-of-concept exploit has been disclosed on GitHub, lowering the operational bar for opportunistic attackers targeting exposed instances.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/view_prod.php` endpoint to remote unauthenticated database manipulation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network exploitation with no prerequisites, yielding partial confidentiality, integrity, and availability impact against the backend database. A public proof-of-concept exploit is available on GitHub (referenced via VulDB), though the product's extremely narrow deployment footprint as a SourceCodester tutorial application limits real-world blast radius significantly.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=add_to_cart` endpoint to unauthenticated remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (PR:N) confirms no authentication is required despite the admin path, and a public exploit has been disclosed via GitHub. The CIA impact is rated limited across all three dimensions, consistent with a read/write SQL injection that does not achieve full system compromise.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_category` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to read or modify the underlying database. The CVSS 4.0 vector confirms no authentication, no user interaction, and no special conditions are required to exploit the flaw. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks against any internet-facing deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin panel's category management endpoint to database manipulation by authenticated remote attackers via the unsanitized `ID` parameter in `/admin/ajax.php?action=save_category`. The vulnerability is a classic CWE-89 flaw in a PHP application with no vendor patch available. A public proof-of-concept exploit exists on GitHub, though no CISA KEV listing confirms active widespread exploitation at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/view_order.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no user interaction required. A public exploit has been released - referenced via GitHub and VulDB - materially raising near-term opportunistic exploitation risk despite the moderate overall score.

Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database.