CVE-2026-78199: SQL Injection in SourceCodester Simple Online Food Ordering System

This vulnerability affects SourceCodester Simple Online Food Ordering System 1.0. An attacker can exploit improper input validation of the ID argument in the /fos/view_prod.php script to perform SQL injection attacks remotely. This could allow unauthorized access or modification of the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, increasing the risk of exploitation. No vendor advisory or patch information is currently provided.

Successful exploitation allows remote attackers to inject SQL commands via the ID parameter, potentially leading to unauthorized data access or manipulation in the backend database. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /fos/view_prod.php. Avoid exposing this vulnerable endpoint publicly if possible.