Executive brief
SourceCodester Simple Online Food Ordering System is a PHP/MySQL web application for managing online food orders. A SQL injection vulnerability in the order confirmation function allows unauthenticated attackers to execute arbitrary database queries, potentially exposing sensitive customer and order data, modifying records, or disrupting service availability.
Technical details
A SQL injection vulnerability exists in /fos/admin/ajax.php?action=confirm_order where the 'id' parameter is passed directly into SQL queries without proper input validation or parameterized statements. The vulnerability is exploitable via HTTP POST requests and requires no prior authentication or user interaction. Attackers can craft malicious payloads using time-based blind or boolean-based blind SQL injection techniques to extract database contents, modify data, or escalate privileges. The root cause is insufficient input sanitization; remediation requires implementing prepared statements with parameter binding and strict input validation.
Affected products
- SourceCodester Simple Online Food Ordering System 1.0
Timeline
- 2026-07-11: disclosed
- 2026-08-24: advisory