CVE-2026-79804: SililaWijesinghe Food Ordering System search.php sql injection

Q: Who can exploit this issue?

The vulnerable search.php endpoint can be exploited remotely without authentication or user interaction. An attacker needs to send a crafted value in the search_box argument.

Q: Are systems exposed by default?

The available data identifies /search.php and its search_box argument as affected, but does not state whether this functionality is enabled or reachable in a default deployment. Any internet-accessible installation exposing that endpoint should be treated as potentially vulnerable.

Q: What should be done if a patch is not available?

No fixed release is identified because the product uses a rolling-release model, and the vendor did not respond to the disclosure. Until a verified fix is available, restrict access to the application or specifically prevent untrusted requests from reaching /search.php where operationally feasible.

Q: How can I determine whether my deployment is affected?

Check whether the deployed code is SililaWijesinghe Food Ordering System at or before commit ba314e897e3365600461e5ea59432e39ceaa0fa5 and whether /search.php accepts the search_box parameter. The supplied information does not provide a specific fixed commit or release for comparison.

Published Aug 25, 2026

Updated

A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Performing a manipulation of the argument searchbox results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

SililaWijesinghe Food Ordering System<=ba314e897e3365600461e5ea59432e39ceaa0fa5

Event History

Aug 25, 2026

CVE Published

via MITRE·09:30 PM

Data Sourced

via MITRE·09:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerable search.php endpoint can be exploited remotely without authentication or user interaction. An attacker needs to send a crafted value in the search_box argument.

Are systems exposed by default?

The available data identifies /search.php and its search_box argument as affected, but does not state whether this functionality is enabled or reachable in a default deployment. Any internet-accessible installation exposing that endpoint should be treated as potentially vulnerable.

What should be done if a patch is not available?

No fixed release is identified because the product uses a rolling-release model, and the vendor did not respond to the disclosure. Until a verified fix is available, restrict access to the application or specifically prevent untrusted requests from reaching /search.php where operationally feasible.

How can I determine whether my deployment is affected?

Check whether the deployed code is SililaWijesinghe Food Ordering System at or before commit ba314e897e3365600461e5ea59432e39ceaa0fa5 and whether /search.php accepts the search_box parameter. The supplied information does not provide a specific fixed commit or release for comparison.

CVE-2026-79804: SililaWijesinghe Food Ordering System search.php sql injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are systems exposed by default?

What should be done if a patch is not available?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are systems exposed by default?

What should be done if a patch is not available?

How can I determine whether my deployment is affected?