Description
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-08-26
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in SourceCodester Simple Online Food Ordering System 1.0 within the /admin/ajax.php file for the login2 action. The email argument can be manipulated to inject arbitrary SQL statements, allowing an attacker to execute unintended queries. This could compromise confidentiality, integrity, and availability of the system’s data.

Affected Systems

The affected product is SourceCodester Simple Online Food Ordering System version 1.0. All installations of this version are impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. It can be triggered remotely from any network location without requiring prior authentication, giving adversaries an accessible attack vector.

Generated by OpenCVE AI on August 27, 2026 at 01:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain an official fix or update from SourceCodester and apply it immediately when released.
  • Modify the application code to use prepared statements or parameterized queries for the email input, ensuring that user data cannot alter the underlying SQL logic.
  • Restrict access to the /admin/ajax.php endpoint by enforcing authentication or limiting traffic to trusted IP addresses before the email parameter is processed.

Generated by OpenCVE AI on August 27, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Title SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection
First Time appeared Sourcecodester
Sourcecodester simple Online Food Ordering System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:simple_online_food_ordering_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester simple Online Food Ordering System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Simple Online Food Ordering System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-26T22:30:11.700Z

Reserved: 2026-08-26T16:41:31.037Z

Link: CVE-2026-81203

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T23:17:20.797

Modified: 2026-08-26T23:17:20.797

Link: CVE-2026-81203

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T02:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')