W5555

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Online Food Ordering System version 1.0 **Description** An issue exists in the `/fos/admin/ajax.php?action=save user` endpoint where improper handling of the `Username` variable allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database. **Recommendations** Update SourceCodester Simple Online Food Ordering System version 1.0 to a version that addresses this issue. As a temporary mitigation, restrict access to the `/fos/admin/ajax.php?action=save user` endpoint or avoid using the `Username` parameter until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Online Food Ordering System version 1.0 **Description** An issue exists in the processing of the '/fos/admin/ajax.php?action=add to cart' endpoint. Remote manipulation of the `pid` variable allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update SourceCodester Simple Online Food Ordering System version 1.0. As a temporary workaround, restrict access to the '/fos/admin/ajax.php?action=add to cart' endpoint or avoid using the `pid` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Simple Online Food Ordering System version 1.0 **Description** An issue exists in the `/fos/view prod.php` file where manipulating the `ID` argument allows for SQL injection, a technique used to interfere with the queries that an application makes to its database. This allows for remote exploitation. **Recommendations** Update SourceCodester Simple Online Food Ordering System version 1.0 to a version that contains a fix for this issue. As a temporary workaround, restrict access to the `/fos/view prod.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Simple Online Leave Management System version 1.0 **Description** A remote SQL injection exists in the `/SimpleOnlineLeave/admin/dashboard.php` endpoint. The issue occurs when the `Name` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.