Description

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-15T23:16:20.913Z",
  "pubdate": "2026-08-15T23:16:20.913Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified within code-projects Online Food Order System 1.0, specifically residing in the delete_food_items1.php script. The flaw stems from the insecure handling of the checkbox argument, which fails to properly sanitize or parameterize user-supplied input before incorporating it into database queries. This vulnerability enables remote attackers to manipulate the input parameter, allowing for the direct execution of arbitrary SQL commands against the underlying database management system. Successful exploitation of this security defect can grant unauthorized actors the ability to bypass authentication mechanisms, access sensitive data, modify or destroy database records, and potentially compromise the integrity and availability of the host application. The risk is significantly elevated due to the public availability of exploit material, increasing the likelihood of automated or targeted exploitation attempts in the wild. Threat actors can execute this attack remotely without requiring prior authentication or privileged access, provided they can reach the vulnerable endpoint over the network.",
  "technicalDetails": "The vulnerability is classified as a SQL injection (SQLi) flaw localized within the delete_food_items1.php component of code-projects Online Food Order System 1.0. The root cause of the issue is the direct and unvalidated concatenation or interpolation of the checkbox parameter into dynamic SQL query strings executed by the application backend. Because the application trusts the incoming HTTP request data without enforcing rigorous input validation, type casting, or parameterized queries, an attacker can supply malicious SQL payloads via the checkbox argument.\nThe attack flow begins with an unauthenticated remote adversary crafting a malicious HTTP request targeting the delete_food_items1.php endpoint. The attacker injects specially crafted SQL syntax into the vulnerable checkbox parameter. When the application processes the deletion logic, it appends the tainted user input directly to the database query structure. The database engine interprets the malicious input as executable database commands rather than literal data strings. This alters the intended logic of the SQL statement, allowing the execution of arbitrary database operations such as UNION-based data retrieval, error-based information extraction, or stacked query execution.\nThe affected component is exposed directly to the network, allowing remote execution over HTTP or HTTPS protocols. There are no authentication or privilege requirements explicitly stated in the vulnerability profile, indicating that external users can interact with the vulnerable file directly. Post-exploitation impact includes unauthorized data exfiltration involving sensitive tables, manipulation of application data, and potential lateral movement or system compromise depending on the database server configurations and underlying database user privileges."
}