CVE-2026-127284: SourceCodester Food Ordering System Admin Write add_category.php sql injection
A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/addcategory.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/currentimage/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied vector. Public exploit code is available, increasing the likelihood of attempted exploitation.
Which inputs should be reviewed for exposure?
The affected Admin Write Handler in admin/add_category.php processes the title, description, price, current_image, featured, active, and id arguments. Manipulation of these arguments can lead to SQL injection.
How can defenders determine whether they may be affected?
Verify whether the deployment is SourceCodester Food Ordering System 1.0 and whether admin/add_category.php is present and reachable. Review application and web-server logs for suspicious requests targeting that path with manipulated category-related parameters.