Description
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Published: 2026-08-24
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

A vulnerability exists in SourceCodester Simple Online Food Ordering System 1.0 that allows manipulation of the ID parameter in the /fos/view_prod.php file, causing a SQL injection flaw. The description states that remote exploitation is possible, indicating that an attacker could send crafted requests over the network. Based on the description, it is inferred that such an injection could enable unauthorized database access, data exfiltration, or modification of application content, but the exact impact is not explicitly detailed.

Affected Systems

The affected product is SourceCodester Simple Online Food Ordering System version 1.0, specifically the /fos/view_prod.php functionality where the ID query parameter is improperly sanitized.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit this flaw over the network, leveraging publicly available exploits. Based on the description and lack of an access control boundary, it is inferred that remote attackers could potentially retrieve or alter data stored in the system's database.

Generated by OpenCVE AI on August 24, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the SourceCodester website for an official patch or update for Simple Online Food Ordering System 1.0
  • Apply any available patch immediately to remove the vulnerable view_prod.php functionality
  • If a patch is not yet released, restrict the view_prod.php endpoint to authorized users only, and ensure that all input parameters are validated and bound using parameterized queries

Generated by OpenCVE AI on August 24, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Title SourceCodester Simple Online Food Ordering System view_prod.php sql injection
First Time appeared Sourcecodester
Sourcecodester simple Online Food Ordering System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_online_food_ordering_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Online Food Ordering System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple Online Food Ordering System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T14:17:21.992Z

Reserved: 2026-08-23T22:35:39.050Z

Link: CVE-2026-78199

cve-icon Vulnrichment

Updated: 2026-08-24T14:17:17.868Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T06:20:46.740

Modified: 2026-08-24T16:41:13.950

Link: CVE-2026-78199

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T07:00:09Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')