CVE-2026-78197

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0

Description An issue exists in the /fos/admin/ajax.php?action=save user endpoint where improper handling of the Username variable allows for remote SQL injection. SQL injection is a technique where an attacker inserts malicious SQL code into a query, potentially allowing them to manipulate the database.

Recommendations Update SourceCodester Simple Online Food Ordering System version 1.0 to a version that addresses this issue. As a temporary mitigation, restrict access to the /fos/admin/ajax.php?action=save user endpoint or avoid using the Username parameter until a fix is applied.