Description

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T06:19:46.750Z",
  "pubdate": "2026-08-24T06:19:46.750Z",
  "executiveSummary": "A security vulnerability has been identified in SourceCodester Simple Online Food Ordering System 1.0, specifically within an unknown processing routine handling the pid parameter. This flaw is classified as a SQL Injection (SQLi) vulnerability, enabling remote unauthenticated or authenticated attackers to manipulate database queries by injecting malicious SQL payloads. Successful exploitation of this vulnerability can lead to unauthorized database access, data exfiltration, modification, or deletion of sensitive information stored within the underlying database. The vulnerability exists due to improper input sanitization and lack of parameterized queries when processing user-supplied data in the administrative backend or cart management functionality. Given that exploit details have been publicly disclosed, the risk of active exploitation in real-world environments is significantly elevated. Organizations deploying this software face severe integrity, confidentiality, and availability risks unless immediate remediation or compensating controls are applied.",
  "technicalDetails": "The vulnerability resides in the backend processing component accessed via the file /fos/admin/ajax.php?action=add_to_cart within SourceCodester Simple Online Food Ordering System 1.0. The root cause of the issue is inadequate validation, sanitization, and escaping of user-supplied input passed through the pid (product ID) HTTP GET or POST parameter before it is concatenated directly into dynamic SQL statements executed against the database management system. Because the application fails to utilize prepared statements, parameterized queries, or robust input type enforcement, an attacker can supply specially crafted SQL syntax encapsulated within the pid parameter. The attack flow initiates when a remote adversary crafts an HTTP request targeting /fos/admin/ajax.php with the action parameter set to add_to_cart and injects malicious SQL commands into the pid argument. When the server-side PHP script processes this request, the injected payload alters the logical structure of the intended SQL query. Depending on the database privileges and the nature of the injected payload, the database engine executes the unauthorized commands. This allows the attacker to perform error-based, union-based, or boolean-based SQL injection techniques. Post-exploitation impact includes the extraction of sensitive data such as administrator credentials, user session tokens, and financial records, or potentially achieving remote code execution if database features such as INTO OUTFILE are leveraged and server configurations permit. Network exposure is remote, as the vulnerable endpoint is accessible over HTTP/HTTPS, and exploitation requires no complex preconditions beyond network connectivity to the web application."
}