CVE-2026-79804: SQL Injection in SililaWijesinghe Food Ordering System

This vulnerability in SililaWijesinghe Food Ordering System up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5 allows remote attackers to exploit SQL injection via the search_box parameter in /search.php. The rolling release approach means no explicit version numbers are provided for affected or fixed releases. The vendor was contacted but did not respond. Public exploit code exists, but no known active exploitation in the wild is reported.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation. The vulnerability is remotely exploitable without user interaction and has low attack complexity. However, the impact is rated medium due to limited scope or partial impact factors.

No official patch or fix has been published by the vendor, and the vendor did not respond to disclosure attempts. Users should monitor vendor communications for updates. In the meantime, applying input validation or web application firewall rules to sanitize the search_box parameter may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.