CVE-2026-78197 is a SQL injection vulnerability affecting SourceCodester Simple Online Food Ordering System 1.0. The flaw exists in the code handling the Username argument in the /fos/admin/ajax.php?action=save_user file, where input is not properly sanitized before being used in SQL queries. This allows an unauthenticated remote attacker to inject malicious SQL commands, potentially compromising the backend database. The vulnerability has been publicly disclosed with exploit code available, but there is no vendor-provided fix or mitigation at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database impacts. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to this vulnerability.