Description

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save_menu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T04:17:38.277Z",
  "pubdate": "2026-08-19T04:17:38.277Z",
  "executiveSummary": "A vulnerability has been identified in SourceCodester Simple Online Food Ordering System 1.0, specifically within the backend processing script located at /admin/ajax.php?action=save_menu. The identified security flaw is classified as a SQL Injection (SQLi) vulnerability, which arises due to the improper neutralization of special elements within user-supplied input prior to inclusion in database queries.\nSuccessful exploitation of this vulnerability allows remote attackers to manipulate the ID parameter, enabling the execution of arbitrary SQL commands against the underlying database. The impact of this vulnerability includes potential unauthorized data access, modification, or deletion, as well as potential compromise of the host application database. The attack vector is fully remote, and the existence of publicly disclosed exploit material significantly increases the risk profile of affected deployments.\nGiven the severity of SQL injection vulnerabilities, immediate remediation is required to secure vulnerable instances against unauthorized database interactions.",
  "technicalDetails": "The vulnerability resides in the /admin/ajax.php endpoint when invoked with the action parameter set to save_menu. Within this operational context, the application processes input passed via the ID parameter. The root cause of the vulnerability is the lack of proper parameterization, input sanitization, or type casting before the ID value is concatenated or interpolated directly into dynamic SQL queries executed by the database management system.\nThe attack flow begins with a remote malicious actor crafting an HTTP request directed at the vulnerable file path /admin/ajax.php?action=save_menu. By injecting malicious SQL syntax into the ID parameter, the attacker can alter the intended logic of the database query. Because the application trusts and blindly executes the tainted input, the database engine interprets the injected strings as executable SQL commands rather than literal data parameters.\nDepending on the nature of the database interaction and the privileges associated with the database user account, this manipulation can lead to error-based, boolean-based, or time-based SQL injection, or direct data extraction via UNION-based queries. The affected component is the database query generation and execution routine tied to the menu saving functionality in version 1.0 of the software.\nThe vulnerability is accessible remotely over the network. Depending on the specific implementation of access controls within /admin/ajax.php, exploitation may or may not require administrative authentication. However, the exposure of backend administrative AJAX endpoints to untrusted remote entities constitutes a severe architectural flaw. Post-exploitation impact encompasses full read and write access to sensitive database tables, potentially exposing administrative credentials, user records, and application data, or facilitating further compromise of the underlying server infrastructure."
}