CVE-2026-78198: Online Food Ordering System SQL Injection

CVE-2026-78198 Overview

CVE-2026-78198 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0. The flaw resides in the /fos/admin/ajax.php?action=add_to_cart endpoint. Attackers can manipulate the pid parameter to inject arbitrary SQL statements into the backend database query. The vulnerability is remotely exploitable, requires no authentication, and requires no user interaction. Public disclosure of the exploit details has already occurred, increasing the risk of opportunistic exploitation against exposed installations.

Critical Impact
Unauthenticated remote attackers can inject SQL through the pid parameter of the add_to_cart action, exposing database contents, credentials, and potentially enabling further compromise of the application.

Affected Products

SourceCodester Simple Online Food Ordering System 1.0
Vulnerable endpoint: /fos/admin/ajax.php?action=add_to_cart
Vulnerable parameter: pid

Discovery Timeline

2026-08-24 - CVE-2026-78198 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78198

Vulnerability Analysis

The application processes the add_to_cart action inside /fos/admin/ajax.php and passes the pid argument directly into a SQL query without proper parameterization or input sanitization. This is a classic injection weakness classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Because the endpoint is reachable over the network and does not require authentication, an attacker can craft HTTP requests that alter the SQL query logic. Successful injection allows the retrieval of data from any table accessible to the database user, including product data, order records, and administrator credentials.

Root Cause

The root cause is the concatenation of untrusted user input into a SQL statement without the use of prepared statements or bound parameters. The pid value supplied by the client is treated as trusted SQL context rather than as data. No allowlist validation, type coercion, or escaping is applied before the query executes.

Attack Vector

Exploitation requires only an HTTP client capable of reaching the vulnerable endpoint. An attacker submits a crafted request to /fos/admin/ajax.php?action=add_to_cart with a malicious pid value, appending SQL syntax such as union-based selects or boolean-based blind payloads. Because the exploit has been disclosed publicly, automated scanners and opportunistic attackers can quickly weaponize it against exposed deployments. See the GitHub Issue Discussion and the VulDB CVE Entry for additional technical context.

No verified proof-of-concept code has been reproduced here. Refer to the linked references for exploitation specifics.

Detection Methods for CVE-2026-78198

Indicators of Compromise

HTTP requests to /fos/admin/ajax.php with action=add_to_cart containing SQL metacharacters in the pid parameter, such as single quotes, UNION SELECT, SLEEP(, or comment sequences (--, #).
Web server or database logs showing malformed SQL errors originating from the add_to_cart handler.
Unusual outbound queries or data volume spikes from the database server tied to cart-related requests.

Detection Strategies

Deploy web application firewall rules that inspect the pid parameter for SQL syntax and reject non-numeric values.
Enable database query auditing to flag queries against product or user tables that originate from the cart endpoint but deviate from expected patterns.
Correlate repeated 500-series HTTP responses from ajax.php with client IPs to surface probing activity.

Monitoring Recommendations

Forward web server access logs and database audit logs to a centralized analytics platform for retention and correlation.
Alert on any request to /fos/admin/ajax.php from unauthenticated sessions or from IP ranges outside expected administrative networks.
Track baseline traffic to the cart endpoint and alert on volumetric anomalies indicative of automated exploitation.

How to Mitigate CVE-2026-78198

Immediate Actions Required

Restrict network access to the Simple Online Food Ordering System admin interface using firewall rules or VPN gating.
Place the application behind a web application firewall configured to block SQL injection payloads targeting the pid parameter.
Review database and application logs for prior exploitation attempts against /fos/admin/ajax.php?action=add_to_cart.
Rotate database credentials and administrator passwords if compromise is suspected.

Patch Information

No official vendor patch has been published for SourceCodester Simple Online Food Ordering System 1.0 at the time of this writing. Consult the SourceCodester Security Resources page and the VulDB Vulnerability Details entry for updates.

Workarounds

Modify the vulnerable query in ajax.php to use parameterized statements via PDO or mysqli prepared statements instead of string concatenation.
Enforce server-side validation that requires pid to be a positive integer before it reaches any database call.
Apply least-privilege permissions to the database account used by the application, removing rights to sensitive tables and administrative operations.
If the system is not actively required, take the application offline until a vendor fix is available.

bash

# Configuration example: block non-numeric pid values at the WAF layer (ModSecurity)
SecRule ARGS:pid "!@rx ^[0-9]+$" \
    "id:1002601,phase:2,deny,status:400,log,\
     msg:'CVE-2026-78198 - Non-numeric pid parameter blocked'"