SQL Injection Vulnerability in SililaWijesinghe Food Ordering System

A SQL injection vulnerability exists in the SililaWijesinghe Food Ordering System, specifically affecting the search_box argument within the search.php file. This vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database. Publicly available exploit code exists, increasing the risk of active exploitation. The product follows a rolling release model, meaning no specific version numbers are provided, and the vulnerability persists in versions up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5. The vendor has not provided a patch or a response to disclosure attempts, necessitating manual monitoring and defensive controls.

Impact

Successful exploitation of this vulnerability allows unauthorized database access, which could lead to data exfiltration, modification of application content, or administrative compromise of the underlying database. Given the application's nature, sensitive customer or order information may be exposed.

Recommendation

• Monitor web application logs for suspicious characters in the search_box parameter, such as single quotes, double dashes, OR/AND logical operators, and UNION SELECT statements.
• Apply strict input validation or use parameterized queries for the search_box parameter in search.php if internal code modifications are possible.
• If the application cannot be patched, place the web server behind a Web Application Firewall (WAF) configured to block SQL injection payloads targeting the /search.php endpoint.
• Restrict database account permissions used by the application to the absolute minimum required for operation to limit the impact of potential injection.