Executive brief
SourceCodester Simple Online Food Ordering System is a web-based restaurant ordering platform used to manage online food orders. A SQL injection vulnerability in the product's view_prod.php file allows attackers to manipulate database queries through the ID parameter, potentially leading to unauthorized access to customer data, order information, and system compromise without requiring login credentials.
Technical details
The vulnerability is a SQL injection flaw in the /fos/view_prod.php file where the 'id' parameter is passed directly into SQL queries without proper input validation or prepared statement use. The vulnerable component accepts GET requests with an unsanitized 'id' parameter and constructs dynamic SQL queries from user input. An unauthenticated attacker can inject malicious SQL code via the 'id' parameter to extract sensitive data, modify database records, or bypass authentication logic. The attack is network-accessible, requires no authentication, and exploitation tools like sqlmap can readily demonstrate time-based and boolean-based blind SQL injection. Patches should implement parameterized queries and strict input validation.
Affected products
- SourceCodester Simple Online Food Ordering System 1.0
Timeline
- 2026-07-11: disclosed: Vulnerability publicly disclosed on GitHub
- 2026-08-24: other: CVE-2026-78199 published