CVE-2026-76996: SQL Injection in SourceCodester Simple Online Food Ordering System

This vulnerability allows an attacker to inject SQL commands via the ID parameter in the /fos/admin/view_order.php script of SourceCodester Simple Online Food Ordering System 1.0. The injection can be performed remotely without authentication, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 score is 6.9 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code is available, but no vendor patch or fix has been disclosed.

Successful exploitation may allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data disclosure or modification. The impact is limited to the confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector. Since the exploit is publicly available, the risk of attacks is elevated.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. In the meantime, applying web application firewalls (WAF) with SQL injection detection rules and restricting access to the affected script may reduce exposure. Avoid exposing the vulnerable endpoint to untrusted networks if possible.