CVE-2026-2136: Online Food Ordering System SQLi Flaw

CVE-2026-2136 Overview

CVE-2026-2136 is a SQL injection vulnerability in Projectworlds Online Food Ordering System 1.0. The flaw resides in the /view-ticket.php script, where the ID parameter is passed into a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote, unauthenticated attackers can manipulate database queries through the ID parameter of /view-ticket.php, potentially exposing or altering stored customer and order data.

Affected Products

Projectworlds Online Food Ordering System 1.0
Component: projectworlds:online_food_ordering_system
Affected endpoint: /view-ticket.php

Discovery Timeline

2026-02-08 - CVE-2026-2136 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-2136

Vulnerability Analysis

The vulnerability exists in the view-ticket.php script of Projectworlds Online Food Ordering System 1.0. The application reads the ID request parameter and concatenates it directly into a SQL query executed against the backend database. Because the input is neither sanitized nor parameterized, attackers can break out of the intended query context and append arbitrary SQL clauses.

The issue maps to CWE-89, Improper Neutralization of Special Elements used in an SQL Command. Successful exploitation can lead to disclosure of database records, modification of stored data, or enumeration of database schema details. Attack complexity is low and no privileges are required, making the flaw practical for automated scanners and opportunistic attackers.

Root Cause

The root cause is the direct use of unvalidated HTTP request input in a SQL statement. The ID parameter is appended to a query string rather than bound as a parameter, allowing query syntax to be altered by attacker-controlled input. PHP applications using mysqli_query or similar APIs without prepared statements are vulnerable to this class of injection.

Attack Vector

An attacker sends a crafted HTTP request to /view-ticket.php with a manipulated ID value containing SQL metacharacters such as a single quote, UNION SELECT, or boolean-based payloads. The request requires no authentication and can be issued from any network position with access to the affected web server. Public proof-of-concept information has been referenced through the GitHub CVE Issue Discussion and VulDB #344771.

The vulnerability mechanism follows the classic UNION-based and error-based SQL injection patterns. See the referenced advisories for technical exploitation details.

Detection Methods for CVE-2026-2136

Indicators of Compromise

HTTP requests to /view-ticket.php containing SQL syntax in the ID parameter, such as single quotes, UNION, SELECT, --, 0x, or SLEEP(
Web server access logs showing repeated requests to view-ticket.php from a single source with varying ID values
Unexpected database error messages returned to clients or logged by the application
Database query logs containing malformed or unusually long SELECT statements originating from the ticket view function

Detection Strategies

Deploy Web Application Firewall (WAF) signatures that flag SQL keywords and metacharacters in the ID query parameter on PHP endpoints
Enable database query logging and alert on queries containing UNION SELECT, INFORMATION_SCHEMA, or stacked statements originating from the application service account
Correlate web access logs with database error rates to identify probing attempts

Monitoring Recommendations

Monitor outbound traffic from the database server for unexpected data egress that may indicate exfiltration
Track HTTP 500 responses from /view-ticket.php as an early signal of injection probing
Alert on anomalous query patterns or response sizes from the ticket viewing endpoint

How to Mitigate CVE-2026-2136

Immediate Actions Required

Restrict public access to the Projectworlds Online Food Ordering System until a fix is applied, using network ACLs or authentication proxies
Audit web server logs for prior exploitation attempts targeting /view-ticket.php
Rotate database credentials and review user account privileges used by the application
Apply input validation on the ID parameter to accept only numeric values

Patch Information

No official vendor patch has been published for Projectworlds Online Food Ordering System 1.0 at the time of disclosure. Refer to the GitHub CVE Issue Discussion and VulDB CTI Incident Report for current advisory status. Operators should consider migrating away from the affected version or applying custom code fixes that replace string concatenation with prepared statements.

Workarounds

Modify view-ticket.php to use parameterized queries via mysqli_prepare or PDO with bound parameters
Cast the ID parameter to an integer using intval($_GET['id']) before use in any SQL statement
Deploy WAF rules blocking SQL metacharacters in query strings to /view-ticket.php
Apply the principle of least privilege to the database account used by the application, removing DROP, ALTER, and write permissions where not required

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on view-ticket.php
SecRule REQUEST_URI "@contains /view-ticket.php" \
  "chain,deny,status:403,id:1002136,msg:'CVE-2026-2136 SQLi attempt'"
  SecRule ARGS:id "@rx (?i)(union|select|sleep|--|';|0x[0-9a-f]+)" "t:none"