Executive brief
An online food ordering system contains a SQL injection vulnerability in its web interface. An attacker can manipulate input parameters to inject malicious database commands, potentially allowing unauthorized access to customer data, menu information, or order records. The vulnerability is remotely exploitable and exploit code has been publicly disclosed.
Technical details
The vulnerability is a SQL injection flaw located in the /web/category-foods.php file affecting an unknown function. The vulnerability exists in the handling of the ID parameter, which is not properly sanitized before being used in database queries. An attacker can craft a malicious request with SQL commands embedded in the ID parameter to bypass authentication, extract sensitive data, or modify database contents. The attack requires only network connectivity (no authentication required) and can be executed remotely. Public exploit code is available, increasing the risk of active exploitation.
Affected products
- SourceCodester katojkalemba Online Food Ordering System 1.0
Timeline
- 2026-09-15: disclosed
- other: Public exploit code released