SOURCECODESTER FOOD ORDERING SYSTEM · CVE-2026-127284 · Other
NO FIX YET · SEE WHAT TO DO
SourceCodester Food Ordering System 1.0 has an SQL injection in admin/add_category.php (title, description, price, current_image, featured, active, id). VulDB says it is exploitable remotely without authentication, and a public proof of concept exists. No fixed version is known.
first public Nov 13, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running the SourceCodester Food Ordering System (PHP/MySQL) version 1.0 where admin/add_category.php is reachable over the network. VulDB states no authentication is needed, and says a public proof of concept exists (the researcher's report is titled as an unauthenticated SQL injection, but I could not read it). Teams not running this product can skip it.
Not affected if admin-path-blocked, product-not-installed
Who cares food-ordering, php, self-hosted, sql-injection, unauthenticated
Posts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.