CVE-2026-30533
SQL Injection in SourceCodester Online Food Ordering Admin Panel
Publication date: 2026-03-27
Last updated on: 2026-03-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oretnom23 | online_food_ordering_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30533 is a SQL Injection vulnerability found in the Online Food Ordering System version 1.0, specifically in the admin/manage_product.php file via the "id" parameter.
The vulnerability occurs because the application does not properly sanitize the "id" parameter received through HTTP GET requests, allowing an authenticated attacker, such as an administrator, to inject arbitrary SQL commands.
The backend database is SQLite, and the injection point supports UNION queries, Boolean-based blind, and time-based blind SQL injection techniques.
This enables attackers to retrieve and display sensitive data directly on the webpage, including administrator credentials and other database contents.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including:
- Data exfiltration: Attackers can retrieve and display entire database contents such as users, orders, and products.
- System compromise: Attackers can enumerate database schema and server information, potentially leading to further exploitation.
- Exposure of sensitive information like administrator credentials.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL Injection vulnerability in the Online Food Ordering System allows attackers to retrieve sensitive data such as user information, orders, products, and administrator credentials. This unauthorized access and potential data exfiltration can lead to violations of data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information.
Because attackers can access and expose confidential data due to improper input sanitization, organizations using the affected system may fail to comply with requirements for data confidentiality, integrity, and security under these standards.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL Injection vulnerability in the Online Food Ordering System v1.0, immediate steps include:
- Restrict access to the affected admin/manage_product.php page to trusted administrators only.
- Avoid using the vulnerable "id" parameter in HTTP GET requests until a patch or fix is applied.
- Implement input validation and sanitization on the "id" parameter to prevent injection of arbitrary SQL commands.
- Use prepared statements or parameterized queries in the backend code to handle database queries safely.
- Monitor and restrict administrator sessions and cookies to prevent unauthorized use of authenticated sessions.
- If possible, deploy web application firewalls (WAF) or intrusion detection systems to detect and block SQL injection attempts.
Ultimately, update or patch the system to a version where this vulnerability is fixed.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the vulnerable parameter "id" in the admin/manage_product.php file for SQL Injection flaws. Automated tools like sqlmap can be used to confirm the presence of the vulnerability.
An example sqlmap command to detect the vulnerability is:
- sqlmap -u "http://127.0.0.1:8088/admin/manage_product.php?id=3" --cookie="PHPSESSID=YOUR_COOKIE_HERE" --batch -v 6 --risk=3
This command tests the "id" parameter by sending multiple HTTP requests to identify SQL Injection points, including UNION query, Boolean-based blind, and time-based blind injections.