CVE-2026-78247: SQL Injection in SourceCodester Simple Online Food Ordering System

SourceCodester Simple Online Food Ordering System 1.0 contains a SQL injection vulnerability in the processing of the 'ID' argument within the /fos/admin/ajax.php?action=confirm_order file. This flaw allows remote attackers to inject malicious SQL commands due to insufficient input validation or sanitization. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, increasing the risk of potential attacks. No vendor advisory or patch information is provided, so remediation status is unknown.

Successful exploitation of this SQL injection vulnerability could allow attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, potentially compromising the confidentiality, integrity, and availability of the system's data. Since the vulnerability is remotely exploitable without authentication, it poses a significant risk if the affected system is exposed to untrusted networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and parameterized queries to the affected endpoint to mitigate SQL injection risks. Monitor for updates from SourceCodester regarding patches or official mitigations.