Description

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save_category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-20T16:18:31.070Z",
  "pubdate": "2026-08-20T16:18:31.070Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within SourceCodester Simple Online Food Ordering System 1.0. The security flaw resides in the handling of input passed to an unknown function within the endpoint /admin/ajax.php?action=save_category. This weakness allows remote attackers to manipulate the ID argument, leading to unauthorized execution of database queries.\nThe impact of this vulnerability is critical, potentially enabling attackers to extract sensitive database contents, bypass authentication mechanisms, modify application data, or execute administrative operations depending on the database privileges associated with the web application.\nThe affected product is SourceCodester Simple Online Food Ordering System version 1.0. The risk implications are severe due to the availability of public exploits, lowering the barrier to entry for malicious actors seeking to compromise vulnerable deployments. The attack can be initiated remotely without requiring prior physical access to the target infrastructure.\nExploitation requirements include network connectivity to the target application instance and the ability to interact with the vulnerable backend administrative AJAX endpoint. No complex prerequisites are explicitly detailed beyond the presence of the vulnerable software version.",
  "technicalDetails": "The root cause of the vulnerability is insufficient input validation and improper sanitization of user-supplied parameters before incorporating them into dynamic SQL queries. Specifically, the ID argument processed by the backend script at /admin/ajax.php?action=save_category fails to implement parameterized queries or proper type casting, leaving the database query structure vulnerable to malicious manipulation.\nThe vulnerable component is the server-side script responsible for category management via AJAX requests, specifically accessed through the path /admin/ajax.php with the action parameter set to save_category. The affected version is explicitly identified as version 1.0 of the SourceCodester Simple Online Food Ordering System.\nRegarding network exposure and access requirements, the vulnerability is exposed over the network, allowing remote attackers to dispatch crafted HTTP requests directly to the application server. Depending on the specific access controls implemented on the administrative routing layer, exploitation may occur pre-authentication or post-authentication, although the administrative context of the endpoint typically implies backend interaction.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious HTTP request targeting /admin/ajax.php?action=save_category. Second, the attacker injects SQL syntax payloads into the vulnerable ID argument parameter. Third, the application forwards the unsanitized input directly to the underlying relational database management system as part of a concatenated SQL statement. Fourth, the database interprets the injected input as executable query logic rather than literal data. Finally, the resulting database execution yields unauthorized data retrieval, data modification, or structural query execution, fulfilling the attacker's objective."
}