CVE-2026-78248 is a SQL injection vulnerability affecting SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in an unspecified function within /fos/admin/ajax.php when processing the 'Name' parameter during the save_settings action. This improper input validation allows remote attackers to inject SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without authentication and has been publicly disclosed. No official fix or mitigation has been documented by the vendor.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other impacts depending on the database permissions and application context. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'Name' parameter in /fos/admin/ajax.php?action=save_settings.