Description

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=delete_category. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-20T16:18:31.243Z",
  "pubdate": "2026-08-20T16:18:31.243Z",
  "executiveSummary": "A security vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0, specifically within an unknown function handling category deletion requests. The vulnerability involves a SQL Injection flaw that arises from the improper sanitization and neutralization of user-supplied input passed through the ID argument.\nSuccessful exploitation of this vulnerability allows remote attackers to manipulate database queries, potentially leading to unauthorized access, data exfiltration, database modification, or complete compromise of the underlying database management system. The flaw presents a significant risk to the confidentiality, integrity, and availability of the affected system.\nThe attack can be launched remotely over the network without requiring complex preconditions, provided the attacker has access to the endpoint. Public disclosure of the exploit increases the likelihood of opportunistic attacks against deployed instances of the application.",
  "technicalDetails": "The vulnerability exists within the backend handler located at the file path /admin/ajax.php?action=delete_category of the SourceCodester Simple Online Food Ordering System 1.0 application. The root cause of the vulnerability is the direct concatenation or improper parameterization of user-supplied input into SQL queries executed against the database.\nSpecifically, the argument ID is processed by the application's backend database handling logic without adequate input validation, type casting, or parameterized query implementation. When a remote attacker sends a specially crafted HTTP request targeting /admin/ajax.php?action=delete_category with a malicious payload injected into the ID parameter, the application interprets the input as executable SQL commands rather than literal data.\nThe attack flow proceeds as follows: First, the remote adversary identifies the vulnerable endpoint /admin/ajax.php?action=delete_category exposed via network protocols. Second, the attacker crafts a malicious HTTP request incorporating SQL injection payloads into the ID parameter. Third, the server processes the input and dynamically constructs a SQL query string containing the untrusted data. Fourth, the database executes the resulting malicious query, altering the intended logic of the database operation.\nDepending on the injected payload, post-exploitation impact may include extracting sensitive database contents such as administrator credentials and user data, bypassing authentication mechanisms, or executing administrative database commands. Network exposure is remote, and the vulnerability affects version 1.0 of the software."
}