Description

A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Performing a manipulation of the argument search_box results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-25T22:17:06.670Z",
  "pubdate": "2026-08-25T22:17:06.670Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the SililaWijesinghe Food Ordering System, specifically within the /search.php script. The vulnerability exists due to improper neutralization of user-supplied input via the search_box parameter.\nThis flaw allows a remote, unauthenticated attacker to manipulate database queries, leading to unauthorized data exposure, potential database modification, or complete system compromise. The vulnerability is publicly disclosed, increasing the risk of exploitation by threat actors targeting vulnerable deployments.\nGiven that the application follows a rolling release model and the vendor has remained unresponsive to disclosure attempts, the risk to organizations utilizing this software is elevated. Organizations are urged to restrict access to the affected file or implement immediate input validation controls.",
  "technicalDetails": "The vulnerability resides in the /search.php component of the SililaWijesinghe Food Ordering System, specifically within the handling of the search_box HTTP parameter. The root cause is an inadequate implementation of input sanitization and parameterization when passing user-provided data into backend SQL queries.\nExploitation is achieved through a SQL injection attack vector where an attacker crafts a malicious input string within the search_box parameter. By injecting SQL syntax (e.g., UNION-based or blind SQL injection payloads), the attacker can alter the intended logic of the database query executed by the server. Because the application fails to utilize prepared statements or parameterized queries, the database engine executes the injected SQL commands with the privileges of the web application's database user.\nThe attack flow proceeds as follows: First, the attacker sends a crafted HTTP request (typically GET or POST) to /search.php containing a payload in the search_box field. Second, the server-side script incorporates this input directly into an SQL statement string. Third, the database executes the modified query, allowing the attacker to bypass authentication, exfiltrate sensitive data from tables, or potentially execute administrative commands depending on the database configuration and permissions. This attack is remotely exploitable without the need for prior authentication, enabling widespread risk to the application's data integrity and confidentiality.\nThe vulnerability affects all deployments of the system up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5. Since the application utilizes a continuous delivery model without distinct versioning, all instances currently running this code are considered vulnerable. The impact of successful exploitation is high, as it facilitates unauthorized database access and provides a vector for further compromise of the underlying server environment."
}