CVE-2026-90855: SourceCodester/katojkalemba Online Food Ordering System order.php sql injection
A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and requires no privileges or user interaction according to the supplied severity vector. Exploitation targets the ID argument handled by /web/order.php.
Is exploit code available?
Yes. The vulnerability data states that a public exploit is available and could be used in attacks.
What is the impact of successful exploitation?
The supplied CVSS vector indicates low confidentiality, integrity, and availability impact. The issue is classified as SQL injection.