Executive brief
SourceCodester Simple Online Food Ordering System is a web-based application that allows restaurants to manage online food orders. A SQL injection vulnerability in the order viewing interface allows remote attackers to inject malicious database commands through an unsanitized parameter, potentially exposing customer data, payment information, and order details, or enabling unauthorized modifications to the system.
Technical details
The vulnerability is a SQL injection flaw in /fos/admin/view_order.php where the 'id' parameter is passed directly into SQL queries without proper input validation or parameterized statements. The attack vector is network-based and does not require authentication or user interaction. An attacker can craft malicious SQL payloads (error-based, time-based blind, boolean-based blind, or UNION query techniques) to extract database contents, modify data, or potentially execute operating system commands depending on database permissions. Input validation, prepared statements with parameter binding, and principle of least privilege for database accounts are recommended mitigations.
Affected products
- SourceCodester Simple Online Food Ordering System 1.0
Timeline
- 2026-07-05: disclosed
- 2026-08-20: advisory