Description
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save_category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-20
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in an undeclared function within the /admin/ajax.php file of SourceCodester Simple Online Food Ordering System 1.0, where manipulating the id argument allows a remote attacker to inject arbitrary SQL statements. This flaw can lead to the unauthorized reading, alteration, or deletion of database contents, compromising the confidentiality, integrity, and availability of the application data.

Affected Systems

The affected product is SourceCodester Simple Online Food Ordering System, version 1.0. No other versions or vendors were listed as affected by the CNA for this CVE.

Risk and Exploitability

The flaw carries a CVSS score of 5.3, indicating a medium severity. The EPSS score is unavailable, but the vulnerability has been publicly disclosed and a working exploit exists, suggesting a realistic likelihood of exploitation. The issue is not currently listed in CISA’s KEV catalog, yet the remote nature of the attack vector and the severity of potential data compromise warrant careful attention.

Generated by OpenCVE AI on August 20, 2026 at 20:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or upgrade to a fixed release of the Simple Online Food Ordering System.
  • Sanitize the id parameter and use parameterized queries or prepared statements to prevent SQL injection.
  • Restrict access to /admin/ajax.php by limiting it to authorized administrative users and applying appropriate firewall or WAF rules to block injection patterns.
  • Monitor application logs for suspicious activity and consider disabling remote access to the admin panel if it is not required.

Generated by OpenCVE AI on August 20, 2026 at 20:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save_category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection
First Time appeared Sourcecodester
Sourcecodester simple Online Food Ordering System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_online_food_ordering_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Online Food Ordering System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple Online Food Ordering System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-20T15:15:12.503Z

Reserved: 2026-08-20T07:16:57.041Z

Link: CVE-2026-76997

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T16:18:31.070

Modified: 2026-08-20T16:18:31.070

Link: CVE-2026-76997

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T20:45:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')