Description

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T14:17:04.050Z",
  "pubdate": "2026-08-24T14:17:04.050Z",
  "executiveSummary": "An SQL injection vulnerability has been identified within SourceCodester Simple Online Food Ordering System version 1.0. The security flaw specifically resides in an unknown function accessed via the endpoint /fos/admin/ajax.php?action=save_settings, where improper sanitization of the Name argument allows malicious database query manipulation. This vulnerability exposes the application to remote attacks, enabling threat actors to execute arbitrary SQL commands against the underlying database management system.\nThe impact of this vulnerability is critical, potentially leading to unauthorized data access, data modification, database exfiltration, or complete compromise of the underlying database infrastructure. The attack can be executed entirely over the network without requiring prior user interaction, provided the attacker can reach the vulnerable administrative AJAX endpoint. Given that exploit details have been publicly disclosed, the risk of active exploitation in the wild is elevated, necessitating immediate defensive measures to secure affected deployments.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and lack of parameterized queries or prepared statements within the settings save functionality of the application. Specifically, the Name argument processed by the backend script at /fos/admin/ajax.php?action=save_settings accepts raw user-supplied input and directly concatenates or interpolates it into dynamic SQL query strings executed against the database.\nAttackers exploit this behavior by supplying crafted SQL payload strings within the Name parameter. Because the application fails to properly sanitize or escape meta-characters such as single quotes, semicolons, and SQL keywords, the database interpreter parses the injected payload as part of the intended command structure. This allows an attacker to alter the logic of the underlying database queries.\nThe attack flow proceeds as follows: First, the remote threat actor crafts an HTTP request targeting the vulnerable endpoint /fos/admin/ajax.php?action=save_settings. Second, the attacker injects malicious SQL syntax into the Name parameter payload. Third, the PHP backend receives the request and executes the insecurely constructed database query. Fourth, the database executes the injected commands, granting the attacker unauthorized interaction with database contents, table structures, or system data depending on database user privileges.\nThe vulnerable component is the administrative AJAX handler managing application settings. The affected product version is SourceCodester Simple Online Food Ordering System 1.0. The attack vector is fully remote over HTTP/HTTPS protocols. Depending on the exact deployment configuration and access controls implemented around the administrative AJAX interface, authentication requirements may vary, though the presence of publicly disclosed exploits indicates that unauthorized or low-privileged interaction is feasible. Post-exploitation impact includes full database compromise, sensitive data exposure, and potential administrative account takeover."
}