CVE-2026-76997: SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates low privileges are required (PR:L). The attack can be initiated remotely over the network and does not require user interaction.
Is public exploit code available?
Yes. The available data states that an exploit has been made public and could be used in attacks.
What component should defenders investigate for exposure?
Investigate the administrative AJAX endpoint at /admin/ajax.php?action=save_category, specifically handling of the ID argument. The affected product version identified in the data is 1.0.