Description

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T06:20:46.740Z",
  "pubdate": "2026-08-24T06:20:46.740Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The security flaw resides in an unspecified function within the /fos/view_prod.php script, specifically affecting the parameter handling of the ID argument. This vulnerability allows remote, unauthenticated attackers to manipulate input parameters maliciously, thereby interacting directly with the underlying database management system.\nThe potential impact of successful exploitation is critical, potentially enabling unauthorized database access, data exfiltration, modification, or destruction depending on database user privileges. Because a public exploit is currently available, the risk to vulnerable deployments is elevated, increasing the likelihood of automated scanning and opportunistic exploitation by threat actors.\nAffected systems are exposed over the network via standard HTTP/HTTPS protocols. Remediation requires immediate source code modification to enforce secure coding standards, such as parameterized queries or prepared statements, to effectively neutralize the injection vector.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in an SQL command, classifying it as a classic SQL Injection (SQLi) flaw. The root cause lies in the application's failure to adequately sanitize, validate, or parameterize user-supplied input passed through the ID argument before concatenating it into dynamic SQL queries executed within the /fos/view_prod.php component.\nAttack flow begins when an unauthenticated remote attacker crafts a malicious HTTP request targeting the vulnerable /fos/view_prod.php endpoint. By injecting specially crafted SQL syntax, escape characters, or boolean-based logic operators into the ID parameter, the attacker alters the intended structure of the database query. The database server parses and executes the modified query under the application's database connection context.\nPost-exploitation impact varies based on database configuration and privileges, but typically includes extraction of sensitive data such as administrator credentials, user personal identifiable information, and order records. In severely misconfigured environments, advanced SQL injection techniques may facilitate database-level remote code execution or file read/write operations.\nThe vulnerable component is explicitly identified as the file /fos/view_prod.php within SourceCodester Simple Online Food Ordering System 1.0. Exploitation does not require prior authentication or privileged access, and network exposure is inherent due to the web-facing nature of the application."
}