CVE-2026-78197: SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=saveuser. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges or user interaction according to the supplied severity vector. The vulnerable request targets /fos/admin/ajax.php?action=save_user and involves the Username argument.
Is public exploit material available?
Yes. The provided data states that an exploit has been made public and could be used in attacks.
What security impact could successful exploitation have?
The severity vector indicates low impacts to confidentiality, integrity, and availability. This is an SQL injection issue, so affected deployments should treat externally reachable instances as exposed until remediated.