Description

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T03:16:53.430Z",
  "pubdate": "2026-08-19T03:16:53.430Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System 1.0, specifically within the login functionality. The flaw exists due to insufficient input sanitization and lack of parameterized queries when handling user-supplied data in the Username parameter.\nAn unauthenticated remote attacker can exploit this vulnerability by sending specially crafted input to the affected endpoint, allowing for the manipulation of SQL database queries executed by the application.\nSuccessful exploitation of this flaw can lead to severe security implications, including unauthorized database access, potential bypass of authentication controls, extraction of sensitive data such as administrative credentials, and full compromise of the underlying database management system.\nGiven that an exploit targeting this vulnerability has been publicly released, the risk level is elevated, necessitating immediate remediation actions by administrators and maintainers of the affected system.",
  "technicalDetails": "The vulnerability resides in the backend processing logic handling authentication requests within SourceCodester Simple Online Food Ordering System 1.0. Specifically, the vulnerable component is accessed via the file /admin/ajax.php?action=login.\nThe root cause of the issue is improper neutralization of special elements within the Username argument before incorporating it into dynamic SQL queries. Because the application fails to utilize prepared statements or parameterized queries, input supplied via the HTTP request is concatenated directly into the SQL statement string.\nAttack flow and exploitation method: An attacker initiates a remote connection to the web application and targets the /admin/ajax.php endpoint with the action parameter set to login. By supplying malicious SQL syntax payloads within the Username parameter, the attacker alters the intended structure of the database query. When the backend database server evaluates the maliciously constructed query, it executes unauthorized commands or logic modifications, such as bypassing authentication checks or returning arbitrary database contents.\nNetwork exposure for this vulnerability is remote, as the login interface is accessible via standard HTTP/HTTPS protocols over the network. Authentication and privilege requirements are minimal or non-existent for the initial exploitation vector, as the flaw resides within the authentication entry point itself, allowing unauthenticated threat actors to interact with the vulnerable function.\nPost-exploitation impact includes unauthorized data exfiltration, database tampering, and potential remote code execution depending on the underlying database server configurations and privileges associated with the database user account."
}