CVE-2026-76048: SourceCodester Simple Online Food Ordering System ajax.php login sql injection
A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Instances of SourceCodester Simple Online Food Ordering System 1.0 that expose the administrative AJAX login endpoint at /admin/ajax.php?action=login are remotely reachable attack targets. No authentication or user interaction is required according to the supplied severity vector.
What does an attacker need to exploit the issue?
An attacker needs network access to the affected endpoint and can manipulate the Username argument in the login request. The attack has low complexity, and a public exploit has been published.
What is the likely impact of a successful attack?
Successful exploitation can result in limited compromise of confidentiality, integrity, and availability, as reflected by C:L, I:L, and A:L in the provided vector.