CVE-2026-76049: Simple Online Food Ordering System SQLi

CVE-2026-76049 Overview

CVE-2026-76049 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0. The flaw exists in the /admin/ajax.php?action=save_menu endpoint, where the ID argument is passed to a backend database query without proper sanitization. Attackers can exploit the issue remotely without authentication or user interaction. Public disclosure of the exploit increases the risk of opportunistic attacks against exposed installations. The vulnerability is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers can inject arbitrary SQL statements through the ID parameter of the save_menu action, potentially reading, modifying, or deleting administrative menu data in the underlying database.

Affected Products

SourceCodester Simple Online Food Ordering System 1.0
Deployments exposing /admin/ajax.php to untrusted networks
Web applications embedding the vulnerable save_menu handler

Discovery Timeline

2026-08-19 - CVE-2026-76049 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76049

Vulnerability Analysis

The vulnerability resides in the administrative AJAX handler /admin/ajax.php when invoked with the action=save_menu parameter. The handler accepts an ID argument from the client request and incorporates it into a SQL statement without parameterization or type enforcement. As a result, an attacker can break out of the intended query context and inject additional SQL syntax.

Because the endpoint is reachable over the network and requires no authentication in the vulnerable configuration, exploitation can be automated at scale. The affected component processes menu data used by the ordering workflow, so successful injection may expose customer, menu, and administrative records stored in the same database.

The issue is classified under [CWE-74]. The EPSS model places the probability of exploitation activity at 0.328% (percentile 25.898) as of 2026-08-21.

Root Cause

The root cause is the direct concatenation of the ID request parameter into a SQL statement inside the save_menu action. The application does not use prepared statements, does not cast the input to an integer, and does not apply an allow-list validator. Any request that reaches the handler can therefore manipulate the query structure.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to /admin/ajax.php?action=save_menu with a malicious payload in the ID parameter. The payload closes the original SQL clause and appends attacker-controlled statements such as UNION SELECT operators or boolean-based conditions. The server executes the composite query and returns data or side effects that reveal database contents.

Exploitation details have been published, as documented in the GitHub Issue Tracker and VulDB CVE Details. No verified proof-of-concept code is reproduced here; refer to the linked advisories for technical specifics.

Detection Methods for CVE-2026-76049

Indicators of Compromise

HTTP requests to /admin/ajax.php containing action=save_menu with non-numeric or SQL metacharacters (', --, UNION, SLEEP) in the ID parameter.
Web server logs showing repeated save_menu POST or GET requests from a single source within a short interval.
Database error messages referencing syntax errors originating from the save_menu code path.
Unexpected modifications to menu records or new administrative rows without a corresponding legitimate admin session.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL metacharacters in the ID parameter of save_menu requests.
Enable database query logging and alert on queries containing UNION operators or conditional time delays tied to the menu tables.
Correlate HTTP access logs with database audit logs to identify anomalous save_menu invocations that produce query errors.

Monitoring Recommendations

Baseline normal traffic patterns for /admin/ajax.php and alert on volume spikes or unusual source geographies.
Monitor outbound connections from the web application host that could indicate data exfiltration following successful injection.
Track file integrity and database schema changes on servers hosting the Simple Online Food Ordering System.

How to Mitigate CVE-2026-76049

Immediate Actions Required

Restrict network access to /admin/ paths using IP allow-lists or VPN-only exposure until a fix is applied.
Place the application behind a WAF with rules blocking SQL injection payloads targeting the ID parameter.
Audit database contents for unauthorized changes to menu, user, and order tables.
Rotate database credentials used by the application after confirming no active compromise.

Patch Information

No vendor patch has been published for CVE-2026-76049 at the time of the NVD entry. SourceCodester distributes the Simple Online Food Ordering System as an open-source project. Administrators should monitor the SourceCodester Security Resource and the VulDB Vulnerability Info for updates, and apply code-level fixes by replacing the vulnerable query with a parameterized statement.

Workarounds

Modify the save_menu handler in /admin/ajax.php to use prepared statements with bound parameters for the ID value.
Cast the ID input to an integer at the application layer before it reaches any SQL context.
Enforce administrative authentication on all /admin/ajax.php actions and disable the endpoint if it is not required in production.

bash

# Example nginx rule to block obvious SQL metacharacters on the vulnerable endpoint
location = /admin/ajax.php {
    if ($arg_action = "save_menu") {
        if ($args ~* "(union|select|sleep\(|--|';)") {
            return 403;
        }
    }
}