CVE-2026-76049: SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied severity vector. Exploitation targets the ID argument in the save_menu action handled by /admin/ajax.php.
Which deployments should be prioritized for investigation?
Deployments of SourceCodester Simple Online Food Ordering System version 1.0 should be investigated, particularly where /admin/ajax.php?action=save_menu is reachable remotely. The available data does not state whether this endpoint is protected by authentication or affected in default installations.
How urgent is remediation?
Remediation should be prioritized because the issue is rated high severity, can be exploited over the network with low attack complexity, and has a publicly disclosed exploit. Successful exploitation may affect confidentiality, integrity, and availability at low impact levels.