CVE-2026-78247: SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirmorder. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of SourceCodester Simple Online Food Ordering System version 1.0 are identified as affected. The vulnerable endpoint is /fos/admin/ajax.php?action=confirm_order.
What does an attacker need to exploit it?
The attack can be performed remotely with low attack complexity, requires no privileges or user interaction, and involves manipulating the ID argument. Public exploit information is available.
What is the potential impact?
Successful exploitation may affect the confidentiality, integrity, and availability of the affected system at low impact levels, according to the supplied CVSS vector.