CVE-2026-78198 is a SQL injection vulnerability affecting SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the processing of the pid argument in the /fos/admin/ajax.php?action=add_to_cart file, which allows an attacker to inject malicious SQL code remotely. The vulnerability has been publicly disclosed, and exploit code may be available. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated as medium severity, reflecting limited but meaningful risk to the affected system's data integrity and confidentiality.

No official patch or remediation has been published by the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is available, consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the pid parameter.