Executive brief
SourceCodester Simple Online Food Ordering System is a PHP-based web application for restaurant food ordering. A SQL injection vulnerability in the admin login endpoint allows unauthenticated attackers to bypass authentication, access sensitive database information, modify records, or take complete control of the application.
Technical details
A SQL injection vulnerability exists in the `/admin/ajax.php?action=login2` endpoint of Simple Online Food Ordering System 1.0. The vulnerability stems from insufficient input validation on the 'email' parameter, which is directly concatenated into SQL queries without parameterization. An unauthenticated attacker can send a POST request with malicious SQL payloads in the email parameter to manipulate database queries. The vulnerability supports both time-based and boolean-based blind SQL injection techniques, allowing attackers to extract sensitive data, authenticate as an admin without credentials, or modify/delete database records. No login is required to exploit this flaw.
Affected products
- SourceCodester Simple Online Food Ordering System 1.0
Timeline
- 2026-07-11: disclosed: Vulnerability disclosed on GitHub
- 2026-08-26: advisory: CVE-2026-81203 published