Description
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-03-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A weakness exists in the Online Food Ordering System 1.0 that allows attackers to manipulate the del argument in the cart.php file, resulting in SQL injection. The flaw permits the alteration or retrieval of data from the underlying database, potentially exposing sensitive information, modifying order data, or causing unintended application behavior. The vulnerability is associated with CWE-74 (Improper Validation of Relative Paths or Filenames) and CWE-89 (SQL Injection).

Affected Systems

The affected product is the code-projects Online Food Ordering System, version 1.0, specifically the Shopping Cart Module accessed via cart.php. Hosts running this exact version or earlier are susceptible, while newer releases may have resolved the issue. The vendor identifying the product is code-projects.

Risk and Exploitability

The CVSS score of 6.9 reflects medium severity, indicating that exploitation can lead to significant data compromise but may not enable full system takeover. EPSS data is unavailable, and the vulnerability is not presently listed in the CISA KEV catalog. Attackers can exercise the flaw remotely by submitting crafted del values, and a public exploit is already available, underscoring that the threat is actionable.

Generated by OpenCVE AI on March 26, 2026 at 05:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify whether the deployed system runs version 1.0 of the Online Food Ordering System.
  • Check the vendor’s website or support channel for a security patch or updated release that addresses the cart.php SQL injection flaw.
  • If no patch is immediately available, modify the cart.php code to reject or sanitize the del parameter, ensuring it only accepts expected integer values.
  • Replace raw query construction with parameterized queries or prepared statements to eliminate injection vectors.
  • Continuously monitor application logs for unusual query patterns or failed login attempts, and limit database privileges to mitigate downstream impact.

Generated by OpenCVE AI on March 26, 2026 at 05:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects
Code-projects online Food Ordering System
Vendors & Products Code-projects
Code-projects online Food Ordering System

Thu, 26 Mar 2026 04:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Title code-projects Online Food Ordering System Shopping Cart cart.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Online Food Ordering System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-26T18:19:15.786Z

Reserved: 2026-03-25T14:40:38.815Z

Link: CVE-2026-4841

cve-icon Vulnrichment

Updated: 2026-03-26T18:19:11.885Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-26T05:16:41.070

Modified: 2026-03-30T13:26:50.827

Link: CVE-2026-4841

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:08:34Z

Weaknesses