{"id":"CVE-2026-127284","kind":"vulnerability","aliases":["CVE-2026-127284"],"related":[],"title":"SourceCodester Food Ordering System: SQL injection in admin category handler","description":"A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.","summary":"SourceCodester Food Ordering System 1.0 has an SQL injection in admin/add_category.php (title, description, price, current_image, featured, active, id). VulDB says it is exploitable remotely without authentication, and a public proof of concept exists. No fixed version is known.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SourceCodester Food Ordering System","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["food-ordering","other","php","self-hosted","sql-injection","unauthenticated"],"not_affected_if":["admin-path-blocked","product-not-installed"],"how_to_check":"- Check whether you run SourceCodester Food Ordering System 1.0 (PHP and MySQL).\n- Look for admin/add_category.php in the web root and test whether it answers without a login session.\n- Review web logs for requests to admin/add_category.php with SQL syntax in title, description, price, current_image, featured, active or id.","fix":"No vendor or NVD fix found; VulDB lists no countermeasure. Until the code is patched, block or restrict /admin/ (IP allowlist, HTTP auth at the web server), or replace the product. Fix to prepared statements is the code-level remedy.","status":"open","published_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:42:56+00:00","updated_at":"2026-11-13T02:45:37+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T02:42:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SourceCodester Food Ordering System: SQL injection in admin category handler","impact":"high","summary":"The admin page admin/add_category.php in SourceCodester Food Ordering System 1.0 does not safely handle the title, description, price and other form arguments sent to it. A remote attacker can inject SQL into the database query, which can expose or alter stored data, and a public exploit has been released.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","self-hosted","food-ordering"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or alters the application database remotely","analyst_note":"Confirm whether the admin area requires login and whether a vendor or NVD fix exists; the sources give no fixed version.","how_to_check":"- Check whether you run SourceCodester Food Ordering System version `1.0`\n- Look for `admin/add_category.php` in the web root\n- unknown","plain_action":"","product_name":"SourceCodester Food Ordering System","needs_analyst":true,"not_affected_if":["product-not-installed"],"who_is_affected":"Sites that run the SourceCodester Food Ordering System 1.0 admin panel, reachable over the network. The sources do not say whether authentication is required to reach the admin write handler. Teams not running this product can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4572,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the admin area requires login and whether a vendor or NVD fix exists; the sources give no fixed version.","search":"'-127284':13A,16A '-2026':12A,15A '1.0':37B,83C 'activ':50B 'admin':8A,96C 'admin/add_category.php':43B,92C 'affect':85C 'argument':104C 'attack':116C,131C 'authent':59B 'categori':9A 'compon':95C 'concept':65B 'current':47B 'cve':11A,14A 'descript':45B 'discov':77C 'exist':66B 'exploit':56B,119C 'featur':49B 'file':91C 'fix':68B 'flaw':74C 'food':2A,18A,22B,34B,80C 'food-ord':21B 'handler':10A,98C 'host':28B 'id':51B 'imag':48B 'initi':114C 'inject':6A,31B,41B,109C 'known':71B 'manipul':101C 'may':127C 'order':3A,23B,35B,81C 'ordering':19A 'part':88C 'perform':99C 'php':25B 'possibl':112C 'price':46B 'proof':63B 'public':62B,125C 'releas':122C 'remot':57B,117C 'result':106C 'say':53B 'secur':73C 'self':27B 'self-host':26B 'sourcecodest':1A,33B,79C 'sourcecodester':17A 'sql':5A,30B,40B,108C 'sql-inject':29B 'system':4A,20A,36B,82C 'titl':44B 'title/description/price/current_image/featured/active/id':105C 'unauthent':32B 'unknown':87C 'use':129C 'version':69B 'vuldb':52B 'without':58B 'write':97C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the SourceCodester Food Ordering System (PHP/MySQL) version 1.0 where admin/add_category.php is reachable over the network. VulDB states no authentication is needed, and says a public proof of concept exists (the researcher's report is titled as an unauthenticated SQL injection, but I could not read it). Teams not running this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["foodorderingsystem","sourcecodesterfoodorderingsystem"],"ptokens":["food","ordering","sourcecodester","system"],"labels":["foodordering","high","other","php","selfhosted","sqlinjection","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-127284':13A,16A '-2026':12A,15A 'admin':8A 'categori':9A 'cve':11A,14A 'food':2A,18A 'handler':10A 'inject':6A 'order':3A 'ordering':19A 'sourcecodest':1A 'sourcecodester':17A 'sql':5A 'system':4A,20A","search_b":"'1.0':37B 'activ':50B 'admin/add_category.php':43B 'authent':59B 'concept':65B 'current':47B 'descript':45B 'exist':66B 'exploit':56B 'featur':49B 'fix':68B 'food':22B,34B 'food-ord':21B 'host':28B 'id':51B 'imag':48B 'inject':31B,41B 'known':71B 'order':23B,35B 'php':25B 'price':46B 'proof':63B 'public':62B 'remot':57B 'say':53B 'self':27B 'self-host':26B 'sourcecodest':33B 'sql':30B,40B 'sql-inject':29B 'system':36B 'titl':44B 'unauthent':32B 'version':69B 'vuldb':52B 'without':58B","search_c":"'1.0':83C 'admin':96C 'admin/add_category.php':92C 'affect':85C 'argument':104C 'attack':116C,131C 'compon':95C 'discov':77C 'exploit':119C 'file':91C 'flaw':74C 'food':80C 'handler':98C 'initi':114C 'inject':109C 'manipul':101C 'may':127C 'order':81C 'part':88C 'perform':99C 'possibl':112C 'public':125C 'releas':122C 'remot':117C 'result':106C 'secur':73C 'sourcecodest':79C 'sql':108C 'system':82C 'title/description/price/current_image/featured/active/id':105C 'unknown':87C 'use':129C 'write':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-127284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127284","severity":null,"published_at":"2026-11-13T02:18:55+00:00","modified_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127284:3805","url":"https://vuldb.com/vuln/436450","severity":null,"published_at":"2026-11-13T02:45:37+00:00","modified_at":"2026-11-13T02:45:37+00:00","first_seen_at":"2026-11-13T02:45:37+00:00","fetched_at":"2026-11-13T02:45:37+00:00","note":"NVD record lists only 1.0 affected, no fix. VulDB (aggregator, not vendor) says no auth required, no countermeasure; GitHub PoC report could not be fetched, so not read. Nothing verified: no vendor page. Exploitation in the wild not reported; X/social not checked.","cites":["https://vuldb.com/vuln/436450","https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md"]}],"documents":[{"id":142068,"url":"https://vuldb.com/vuln/436450","title":"VulDB VDB-436450: Food Ordering System 1.0 add_category.php SQL injection","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":142069,"url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md","title":"yuechuya report: Food Ordering System unauthenticated SQL injection (not readable by analyst)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}