Description

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T05:16:55.917Z",
  "pubdate": "2026-08-24T05:16:55.917Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within SourceCodester Simple Online Food Ordering System 1.0. This security flaw resides in the administrative backend functionality processed by the file /fos/admin/ajax.php?action=save_user. Specifically, improper sanitization and lack of parameterized queries on the Username argument allow remote unauthenticated or authenticated attackers to inject malicious SQL commands directly into database queries.\nThe primary impact of this vulnerability includes unauthorized database access, potential data exfiltration, modification or deletion of critical records, and complete compromise of the underlying database management system. Given that public exploits are currently available, the risk to deployed instances is critically high.\nAttackers can initiate this exploit remotely over the network without requiring complex prerequisites beyond reaching the target application endpoint. The vulnerability exposes the system to automated scanning and targeted exploitation, necessitating immediate remediation to prevent full administrative takeover and unauthorized data exposure.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper handling of user-supplied data within the database interaction layer of SourceCodester Simple Online Food Ordering System 1.0. Specifically, the vulnerable component is located in the backend script /fos/admin/ajax.php when processing the action parameter set to save_user.\nDuring the execution of the user creation or modification routine, the application dynamically constructs SQL statements by directly concatenating or interpolating the input provided via the Username argument without applying adequate context-aware escaping or utilizing parameterized prepared statements. This architectural flaw allows an attacker to break out of the intended SQL query structure and append arbitrary SQL commands.\nThe attack flow proceeds as follows: First, the adversary crafts a malicious HTTP POST or GET request targeting the /fos/admin/ajax.php endpoint with the action parameter explicitly set to save_user. Second, the payload containing SQL syntax (such as UNION-based statements, stacked queries, or boolean-based conditional injections) is injected into the Username parameter. Third, the backend application processes the request and executes the tainted SQL string against the database backend. Finally, the database interprets the injected commands as executable SQL instructions, returning unauthorized data sets or modifying database states depending on the nature of the payload.\nThe network exposure for this vulnerability is remote, meaning any attacker with HTTP accessibility to the web application can initiate the attack. Depending on the application implementation surrounding the /fos/admin/ajax.php endpoint, authentication may or may not act as a barrier, though administrative AJAX functionalities in similar source code often suffer from broken access controls or session validation flaws. The post-exploitation impact includes full read and write access to the application database, potential extraction of administrative credentials, session hijacking, and potential Remote Code Execution if database privileges and configurations permit file system interactions."
}