CVE-2026-78197: SQL Injection in SourceCodester Simple Online Food Ordering System

SourceCodester Simple Online Food Ordering System 1.0 contains a SQL injection vulnerability in the /fos/admin/ajax.php?action=save_user file. The vulnerability arises from improper sanitization of the Username argument, allowing an attacker to inject SQL commands remotely. This can lead to unauthorized database queries or modifications. The vulnerability is publicly known and exploitable, but no official patch or remediation information is provided in the available data.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the database privileges of the application. The vulnerability is remotely exploitable without authentication, increasing its risk. However, no specific details on exploitation in the wild or further impact are provided.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the vulnerable endpoint, apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Username parameter, and monitor for suspicious activity related to this endpoint.