Description

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T04:17:42.060Z",
  "pubdate": "2026-08-19T04:17:42.060Z",
  "executiveSummary": "A SQL Injection vulnerability has been identified within SourceCodester Simple Online Food Ordering System 1.0. This security flaw impacts an unspecified function within the /admin/ajax.php?action=delete_menu file, where improper handling of the ID argument allows malicious SQL command insertion. The vulnerability can be exploited remotely over the network by unauthenticated or unauthorized remote attackers depending on session enforcement, posing a significant risk to data confidentiality, integrity, and availability. Successful exploitation of this flaw enables malicious actors to manipulate backend database queries, potentially leading to unauthorized data extraction, database modification, or complete system compromise. Publicly available exploit vectors increase the likelihood of opportunistic attacks targeting deployments of this software.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation and a lack of parameterization within the database interaction logic of the /admin/ajax.php endpoint when processing the delete_menu action. Specifically, the ID parameter supplied via HTTP requests is concatenated or directly interpolated into SQL database queries without proper sanitization, escaping, or the use of prepared statements. The affected component resides in the backend PHP script handling administrative AJAX requests specifically associated with menu deletion operations. Attackers can exploit this flaw by sending specially crafted HTTP requests to /admin/ajax.php?action=delete_menu, injecting malicious SQL payloads into the vulnerable ID parameter. The attack flow involves the web application receiving the malicious input, constructing an unsafe SQL query using the tainted parameter, and executing it directly against the underlying relational database management system. This alters the intended logic of the SQL statement, allowing the attacker to execute arbitrary database commands within the context of the database user account. Depending on the database privileges, post-exploitation impact includes the enumeration of database tables, extraction of sensitive administrative or user credentials, bypassing authentication mechanisms, or executing administrative database maintenance operations that could destabilize or compromise the host environment. The vulnerability is present in version 1.0 of the software, requires network connectivity to the target web application, and can be executed remotely without complex prerequisites if public exploits are leveraged."
}