SourceCodester Food Ordering System SQL Injection (CVE-2026-127284)
SourceCodester Food Ordering System 1.0 is vulnerable to remote SQL injection via the admin/add_category.php component.
CVE search metadata
CVE search record: CVE-2026-127284. Severity: high. CVSS: 7.3. KEV: no. Product: Food Ordering System 1.0. Brief: SourceCodester Food Ordering System SQL Injection (CVE-2026-127284). Brief link: https://feed.craftedsignal.io/briefs/2026-11-food-ordering-sql-injection-cve-2026-127284/
Triage facts
Revision 1- Applicability
- Food Ordering System 1.0
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 04:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
SourceCodester Food Ordering System 1.0 contains a SQL injection vulnerability within the Admin Write Handler component. Remote attackers can manipulate the title, description, price, current_image, featured, active, or id arguments within the admin/add_category.php file to execute SQL commands.
Impact
Successful exploitation allows remote attackers to execute arbitrary SQL commands against the backend database. The vulnerability has a CVSS v3.1 base score of 7.3.
Recommendation
Administrators should monitor web logs for suspicious activity targeting the affected file.
Threat Hunt
Monitor web server access logs for HTTP POST requests directed at 'admin/add_category.php' containing suspicious SQL syntax (e.g., UNION, SELECT, OR 1=1) within the 'title', 'description', 'price', 'current_image', 'featured', 'active', or 'id' arguments.
Data: web_server_access_logs