CVE-2026-81203: SQL Injection in SourceCodester Simple Online Food Ordering System

CVE-2026-81203 describes a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0. The flaw exists in the /admin/ajax.php?action=login2 file where the 'email' argument is not properly sanitized, enabling remote attackers to perform SQL injection attacks. The vulnerability allows unauthorized manipulation of backend database queries. The CVSS 4.0 vector indicates network attack vector with low complexity and no privileges or user interaction required, but with low to limited confidentiality, integrity, and availability impact. No vendor advisory or patch information is available at this time.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the vulnerable endpoint and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'email' parameter.