Executive brief
A security vulnerability exists in the Online Food Order System, a web application used for managing food orders. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information or the disruption of business operations. This attack can be carried out remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in code-projects Online Food Order System 1.0 within the '/edit_food_items.php' component. The root cause is the improper neutralization of special elements used in an SQL command, specifically affecting the 'update' parameter. An unauthenticated remote attacker can provide malicious input to manipulate SQL queries, enabling unauthorized database access, data extraction, or modification. The vulnerability can be exploited using error-based or time-based blind SQL injection techniques. Public exploit code (PoC) has been released, and no official patch is currently documented.
Affected products
- code-projects Online Food Order System 1.0
Timeline
- 2026-06-07: disclosed: Initial disclosure on GitHub issue tracker
- 2026-07-09: advisory: NVD publication date