PT-2026-79827

CVE-2026-78198

Published

2026-08-24

Updated

2026-08-24

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0

Description An issue exists in the processing of the '/fos/admin/ajax.php?action=add to cart' endpoint. Remote manipulation of the pid variable allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Update SourceCodester Simple Online Food Ordering System version 1.0. As a temporary workaround, restrict access to the '/fos/admin/ajax.php?action=add to cart' endpoint or avoid using the pid parameter until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

W5555

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers