CVE-2026-78197: Online Food Ordering System SQL Injection

CVE-2026-78197 Overview

CVE-2026-78197 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0. The flaw resides in /fos/admin/ajax.php?action=save_user, where the Username parameter is passed to a database query without proper sanitization. Attackers can trigger the vulnerability remotely without authentication and manipulate the underlying SQL statement. Public exploit details have been disclosed, increasing the risk of opportunistic exploitation against exposed installations. The weakness is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote, unauthenticated attackers can inject arbitrary SQL through the Username parameter, exposing administrative user data and enabling tampering with the backend database.

Affected Products

SourceCodester Simple Online Food Ordering System 1.0
Deployments exposing /fos/admin/ajax.php to untrusted networks
Any derivative or fork reusing the vulnerable save_user handler

Discovery Timeline

2026-08-24 - CVE-2026-78197 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78197

Vulnerability Analysis

The vulnerability exists in the administrative AJAX endpoint responsible for saving user accounts. The save_user action accepts a Username parameter from HTTP requests and concatenates it directly into a SQL query. Because the application does not use parameterized statements or apply input validation, attackers can break out of the intended string context and append arbitrary SQL clauses. Exploitation succeeds over the network without prior authentication, which broadens the pool of viable attackers to anyone able to reach the admin AJAX handler. The scope of impact is limited to the underlying database, but includes credential storage tables used for administrative access.

Root Cause

The root cause is unsanitized concatenation of user-controlled input into a SQL statement inside the save_user handler in ajax.php. The code path does not bind parameters, escape input, or enforce a strict character allowlist on the Username field. This class of issue is categorized under CWE-74, covering improper neutralization of special elements passed to a downstream interpreter.

Attack Vector

An attacker submits a crafted HTTP request to /fos/admin/ajax.php?action=save_user with a malicious Username payload. Because the endpoint is reachable over the network and requires no authentication, exploitation can be automated. Successful injection allows the attacker to enumerate database schema, extract stored credentials, and modify or delete records. Public exploit details are referenced in the GitHub Issue Discussion and the VulDB CVE Entry.

No verified exploit code is reproduced here. See the VulDB Vulnerability Listing for technical exploitation details.

Detection Methods for CVE-2026-78197

Indicators of Compromise

HTTP requests to /fos/admin/ajax.php containing the action=save_user parameter with SQL metacharacters such as ', --, UNION, or SLEEP( in the Username field.
Unexpected administrative account creation or modification events in the users table.
Database error messages surfaced in application logs referencing syntax errors near the Username value.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST bodies and query strings to ajax.php?action=save_user for SQL injection patterns.
Enable database query logging and alert on queries against the users table that contain tautologies, UNION SELECT, or time-based delay functions.
Correlate spikes in 500-level responses from /fos/admin/ajax.php with client IPs to identify probing activity.

Monitoring Recommendations

Monitor administrative endpoints for unauthenticated access attempts and rate anomalies from single source IPs.
Track changes to privileged accounts and alert on any account creation outside a documented change window.
Forward web server, PHP, and MySQL logs to a centralized analytics platform for long-term retention and cross-source correlation.

How to Mitigate CVE-2026-78197

Immediate Actions Required

Restrict access to /fos/admin/ using IP allowlisting, VPN, or reverse-proxy authentication until a fix is applied.
Audit the users table for unauthorized entries and reset credentials for all administrative accounts.
Deploy a WAF signature blocking SQL injection patterns targeting the Username parameter on save_user.

Patch Information

No official vendor patch has been published in the referenced advisories. Operators should consult the SourceCodester Security Resource for updates and monitor the VulDB CVE Entry for remediation guidance. Until a vendor fix is available, remediate the code path by replacing string concatenation with prepared statements using mysqli or PDO bindings on the Username input.

Workarounds

Modify ajax.php to validate Username against a strict allowlist of alphanumeric characters before it reaches any SQL statement.
Refactor the save_user handler to use parameterized queries with bound parameters.
Remove or disable the vulnerable endpoint entirely if the administrative UI is not required for production operation.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on save_user
SecRule REQUEST_URI "@contains /fos/admin/ajax.php" \
  "chain,phase:2,deny,status:403,id:1002026,\
  msg:'CVE-2026-78197 SQLi attempt on save_user'"
  SecRule ARGS:Username "@rx (?i)(\bunion\b|--|';|sleep\(|benchmark\()" "t:none"