---
id: "CVE-2026-127284"
page: "https://infrastack.ai/live/CVE-2026-127284"
kind: "vulnerability"
aliases: ["CVE-2026-127284"]
title: "SourceCodester Food Ordering System: SQL injection in admin category handler"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "SourceCodester Food Ordering System", "fixed": [], "affected": "1.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["food-ordering", "other", "php", "self-hosted", "sql-injection", "unauthenticated"]
not_affected_if: ["admin-path-blocked", "product-not-installed"]
published_at: "2026-11-13T02:18:55+00:00"
first_seen_at: "2026-11-13T02:41:36+00:00"
updated_at: "2026-11-13T02:45:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127284", "first_seen_at": "2026-11-13T02:41:36+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/436450", "first_seen_at": "2026-11-13T02:45:37+00:00", "cites": ["https://vuldb.com/vuln/436450", "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md"]}]
exploit_sources: [{"type": "poc", "url": "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md"}]
---

# SourceCodester Food Ordering System: SQL injection in admin category handler

Link for people: https://infrastack.ai/live/CVE-2026-127284 (this .md is for agents)

SourceCodester Food Ordering System 1.0 has an SQL injection in admin/add_category.php (title, description, price, current_image, featured, active, id). VulDB says it is exploitable remotely without authentication, and a public proof of concept exists. No fixed version is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SourceCodester Food Ordering System affected 1.0 fixed no fixed version listed

## How to check

- Check whether you run SourceCodester Food Ordering System 1.0 (PHP and MySQL).
- Look for admin/add_category.php in the web root and test whether it answers without a login session.
- Review web logs for requests to admin/add_category.php with SQL syntax in title, description, price, current_image, featured, active or id.

## Fix

No vendor or NVD fix found; VulDB lists no countermeasure. Until the code is patched, block or restrict /admin/ (IP allowlist, HTTP auth at the web server), or replace the product. Fix to prepared statements is the code-level remedy.

## Timeline

- 2026-11-13T02:41:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127284
- 2026-11-13T02:45:37+00:00 analyst https://vuldb.com/vuln/436450 — NVD record lists only 1.0 affected, no fix. VulDB (aggregator, not vendor) says no auth required, no countermeasure; GitHub PoC report could not be fetched, so not read. Nothing verified: no vendor page. Exploitation in the wild not reported; X/social not checked.

## Documents

- [describes] VulDB VDB-436450: Food Ordering System 1.0 add_category.php SQL injection https://vuldb.com/vuln/436450
- [poc] yuechuya report: Food Ordering System unauthenticated SQL injection (not readable by analyst) https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md

## From the sources

A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_