CVE-2026-78199

SourceCodester Simple Online Food Ordering System view_prod.php sql injection

View on CVE.org
Published Aug 24, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Analysis

AI-generated

Technical impact

A vulnerability exists in SourceCodester Simple Online Food Ordering System 1.0 that allows manipulation of the ID parameter in the /fos/view_prod.php file, causing a SQL injection flaw. The description states that remote exploitation is possible, indicating that an attacker could send crafted requests over the network. Based on the description, it is inferred that such an injection could enable unauthorized database access, data exfiltration, or modification of application content, but the exact impact is not explicitly detailed.

Affected Systems

The affected product is SourceCodester Simple Online Food Ordering System version 1.0, specifically the /fos/view_prod.php functionality where the ID query parameter is improperly sanitized.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit this flaw over the network, leveraging publicly available exploits. Based on the description and lack of an access control boundary, it is inferred that remote attackers could potentially retrieve or alter data stored in the system's database.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the SourceCodester website for an official patch or update for Simple Online Food Ordering System 1.0
  • Apply any available patch immediately to remove the vulnerable view_prod.php functionality
  • If a patch is not yet released, restrict the view_prod.php endpoint to authorized users only, and ensure that all input parameters are validated and bound using parameterized queries

Generated by OpenCVE AI on August 24, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Title SourceCodester Simple Online Food Ordering System view_prod.php sql injection
First Time appeared Sourcecodester
Sourcecodester simple Online Food Ordering System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_online_food_ordering_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Online Food Ordering System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 24, 2026, 2:17 PM
Reserved
Aug 23, 2026, 10:35 PM

View source JSON

Updated
Aug 24, 2026, 2:17 PM

JSON

Status
Deferred
Published
Aug 24, 2026, 6:20 AM
Modified
Oct 12, 2026, 4:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 7:00 AM

JSON