SQL Injection Vulnerability in Simple Online Food Ordering System

A SQL injection vulnerability, identified as CVE-2026-81203, exists within the admin module of the SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability is located in the /admin/ajax.php file, specifically within the login2 action. Attackers can reach this endpoint remotely and perform malicious manipulation of the email argument. Because this flaw allows for arbitrary SQL command execution, it can potentially lead to unauthorized data exfiltration, modification of database contents, or authentication bypass. The vulnerability has been disclosed publicly, making it available for exploitation. Organizations using this system should restrict access to the /admin/ directory and validate all inputs against the application logic.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database. This may result in full compromise of the application data, administrative account takeovers, or further exploitation of the underlying database server, depending on the privileges assigned to the database user.

Recommendation

• Restrict network access to the /admin/ directory using firewall or web application firewall rules to prevent unauthorized remote requests.
• Apply input sanitization and parameterization to the 'email' argument within /admin/ajax.php to mitigate SQL injection vectors.
• Audit database logs for anomalous queries originating from the /admin/ajax.php endpoint.