Executive brief
SourceCodester's Simple Online Food Ordering System is a web-based restaurant ordering platform. A SQL injection vulnerability in the cart management function allows unauthenticated attackers to manipulate database queries, potentially exposing sensitive customer and business data, modifying orders, or taking down the system.
Technical details
A SQL injection vulnerability exists in the /fos/admin/ajax.php endpoint (action=add_to_cart) where the 'pid' parameter is directly concatenated into SQL queries without proper input validation or parameterized statements. The vulnerability requires no authentication and can be exploited via a POST request to inject malicious SQL. An attacker can use time-based blind SQL injection techniques to extract database contents, modify data, or execute arbitrary database operations. The root cause is insufficient input sanitization on the pid parameter. No patches are currently documented.
Affected products
- SourceCodester Simple Online Food Ordering System 1.0
Timeline
- 2026-07-11: disclosed: SQL injection vulnerability disclosed on GitHub
- 2026-08-24: advisory: CVE-2026-78198 published