Executive brief
SourceCodester's Simple Online Food Ordering System is a PHP/MySQL web application used to manage online food ordering operations. An attacker can inject malicious SQL commands through the category management interface without authentication, allowing unauthorized database access, data theft, modification, or deletion. This could expose customer orders, payment information, and other sensitive business data.
Technical details
A SQL injection vulnerability exists in /fos/admin/ajax.php?action=save_category where the 'id' parameter is passed directly into SQL queries without proper input validation or prepared statements. The vulnerability is accessible remotely via POST request and requires no authentication, making it easily exploitable. An attacker can craft malicious SQL payloads in the 'id' parameter to execute arbitrary database queries, extract sensitive information via time-based or boolean-based blind SQL injection techniques, or modify/delete data. The recommended fix is to implement prepared statements with parameter binding, enforce strict input validation, apply the principle of least privilege to database user accounts, and conduct regular security audits.
Affected products
- SourceCodester Simple Online Food Ordering System 1.0
Timeline
- 2026-07-05: disclosed
- 2026-08-20: advisory