Description

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-20T15:18:40.783Z",
  "pubdate": "2026-08-20T15:18:40.783Z",
  "executiveSummary": "A critical security flaw has been identified in SourceCodester Simple Online Food Ordering System 1.0, specifically within an unknown function handling parameters in the file /fos/admin/view_order.php. This vulnerability is classified as a SQL Injection (SQLi) flaw, enabling remote attackers to manipulate input arguments to execute arbitrary database queries. The impact of successful exploitation includes unauthorized access to sensitive backend database contents, potential data tampering, and compromise of system integrity. The vulnerability presents a severe risk as remote exploitation is feasible without complex prerequisites, and public availability of exploit material lowers the barrier for malicious actors. Affected systems include deployments of SourceCodester Simple Online Food Ordering System version 1.0 utilizing the vulnerable endpoint. Mitigation requires immediate input validation and parameterized query implementation to neutralize the injection vector.",
  "technicalDetails": "The vulnerability resides in the /fos/admin/view_order.php script of SourceCodester Simple Online Food Ordering System 1.0, where user-supplied input passed via the ID argument is insufficiently sanitized or validated before being concatenated directly into database query structures. This architectural weakness constitutes a classic SQL Injection (SQLi) vulnerability, allowing malicious inputs to alter the intended logic of backend database operations.\nExploitation of this flaw occurs remotely over the network when an attacker interacts with the vulnerable /fos/admin/view_order.php endpoint. By supplying a specially crafted payload via the ID parameter, the attacker can manipulate the query execution flow. The underlying database engine interprets the injected malicious strings as executable SQL commands rather than inert literal data.\nThe attack flow proceeds as follows: First, the remote adversary identifies the target application running SourceCodester Simple Online Food Ordering System 1.0. Second, the adversary crafts a malicious HTTP request targeting the /fos/admin/view_order.php script, appending SQL syntax payloads to the ID argument. Third, the application processes the input and concatenates it directly into the database query without utilizing prepared statements or parameterized queries. Fourth, the database executes the modified query, returning unauthorized data sets or performing unauthorized database operations back to the attacker.\nThe root cause of the vulnerability stems from improper neutralization of special elements within SQL commands. The component affected is the backend database query handler processing the ID parameter within the administrative order viewing functionality. Depending on database configurations and underlying database privileges, successful exploitation may lead to comprehensive data extraction, administrative account takeover, or arbitrary database modifications."
}