CVE-2026-79804: SQL Injection in SililaWijesinghe Food Ordering System

This vulnerability exists in the SililaWijesinghe Food Ordering System up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5. The issue is an SQL injection in the /search.php file triggered by manipulation of the search_box parameter. Remote exploitation is possible without authentication or user interaction. The vendor has not provided any response or fix, and the rolling release nature of the product means no specific versioning information is available. Public exploit code exists but no active exploitation has been confirmed.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low complexity, and no privileges or user interaction required. The impact on confidentiality, integrity, and availability is rated low to limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying temporary mitigations such as input validation or web application firewalls to block malicious SQL injection payloads targeting the search_box parameter. Monitor for updates from the vendor or trusted security sources.