Executive brief
A vulnerability exists in the CodeAstro Online Catering Ordering System, a web application used for managing food service orders. An attacker can exploit this flaw to interfere with the underlying database, potentially leading to the unauthorized viewing, modification, or deletion of order records. This could disrupt business operations and compromise customer or transaction data.
Technical details
A SQL injection vulnerability exists in CodeAstro Online Catering Ordering System 1.0 within the 'deleteorder.php' component. The application fails to properly sanitize or validate the 'id' GET parameter before using it in a database query. A remote attacker with low privileges can provide a malicious payload (such as time-based blind SQL injection) to manipulate SQL queries. This allows for unauthorized database access, data leakage, or tampering. A public exploit (PoC) using sqlmap has been disclosed.
Affected products
- CodeAstro Online Catering Ordering System 1.0
Timeline
- 2026-04-21: disclosed: Initial disclosure on GitHub issue tracker
- 2026-05-10: advisory: CVE published and NVD record created