Description
A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Published: 2026-08-15
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a SQL injection flaw in delete_food_items1.php of the Online Food Order System. By manipulating the checkbox argument, an attacker can inject arbitrary SQL code, allowing remote execution of commands that may alter or delete data. The flaw corresponds to CWE-74 and CWE-89.

Affected Systems

Versions 1.0 of code-projects Online Food Order System are affected. The flaw occurs in delete_food_items1.php, and no other product editions or versions are mentioned.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available; however, an exploit has been published and can be performed remotely. The vulnerability is known but not listed in CISA KEV, suggesting limited but possible exploitation if the system is publicly reachable.

Generated by OpenCVE AI on August 16, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the application to the vendor-released patch that corrects delete_food_items1.php or, if no patch is available, restrict access to that page by limiting it to authenticated administrators or disabling it entirely.
  • Replace the vulnerable code with parameterized queries or an ORM that prevents injection of user-supplied data.
  • Configure the database user used by the application with the least privileges needed for operation and audit SQL activity for irregular patterns.

Generated by OpenCVE AI on August 16, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Title code-projects Online Food Order System delete_food_items1.php sql injection
First Time appeared Code-projects
Code-projects online Food Order System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:online_food_order_system:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects online Food Order System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Food Order System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-15T23:00:11.011Z

Reserved: 2026-08-15T05:08:22.051Z

Link: CVE-2026-19917

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T23:16:20.913

Modified: 2026-08-15T23:16:20.913

Link: CVE-2026-19917

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T00:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')