CVE-2026-79804 Overview
CVE-2026-79804 is a SQL injection vulnerability in the SililaWijesinghe Food Ordering System, affecting builds up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5. The flaw resides in /search.php, where the search_box parameter is passed to a database query without proper sanitization. Remote attackers can exploit this issue over the network without authentication or user interaction. Public exploit details are available through the GitHub CVE Issue Tracker and VulDB Vulnerability Details. The project follows a rolling-release model, and the vendor did not respond to the disclosure. The weakness is classified as [CWE-74] (Improper Neutralization of Special Elements).
Critical Impact
An unauthenticated remote attacker can manipulate the search_box parameter to inject arbitrary SQL, potentially exposing menu data, customer records, and order history.
Affected Products
- SililaWijesinghe Food Ordering System (rolling release)
- Builds up to and including commit ba314e897e3365600461e5ea59432e39ceaa0fa5
- Component: /search.php
Discovery Timeline
- 2026-08-25 - CVE-2026-79804 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79804
Vulnerability Analysis
The vulnerability is a classic SQL injection in the search endpoint of the Food Ordering System. The /search.php script accepts the search_box request parameter and concatenates it into a SQL query without parameterized statements or input validation. Attackers can craft malicious payloads that alter query logic, extract records from the underlying database, or manipulate stored data. Because the endpoint is exposed over HTTP and does not require authentication, exploitation can be performed remotely with a single crafted request. The CWE-74 classification reflects improper neutralization of special elements that reach a downstream interpreter, which in this case is the SQL engine.
Root Cause
The root cause is the direct inclusion of user-supplied input in a SQL statement. The application does not apply prepared statements, parameter binding, or context-aware escaping before executing the query. Any string containing SQL metacharacters submitted through search_box is interpreted by the database.
Attack Vector
An attacker sends an HTTP request to /search.php with a manipulated search_box value containing SQL syntax. Typical payloads use boolean logic, UNION SELECT statements, or time-based conditions to enumerate databases and exfiltrate data. No authentication, privileges, or user interaction are required.
No verified proof-of-concept code is published in this advisory. See the GitHub CVE Issue Tracker for public technical details.
Detection Methods for CVE-2026-79804
Indicators of Compromise
- HTTP requests to /search.php containing SQL metacharacters such as ', --, UNION, SELECT, SLEEP(, or information_schema in the search_box parameter.
- Web server access logs showing unusually long or URL-encoded values for search_box from a single source IP.
- Database error messages returned to clients or logged from queries originating in the search handler.
Detection Strategies
- Deploy web application firewall (WAF) signatures for common SQL injection patterns targeting the search_box parameter.
- Correlate elevated error rates from the PHP application with abnormal query patterns in database audit logs.
- Monitor for time-based injection indicators, including repeatable request-latency spikes tied to SLEEP or BENCHMARK payloads.
Monitoring Recommendations
- Enable verbose access logging on the web server and forward logs to a centralized analytics platform for query inspection.
- Instrument the database with query logging to capture full SQL statements from the application user for anomaly review.
- Alert on repeated 4xx or 5xx responses from /search.php that follow a scanning pattern from the same IP range.
How to Mitigate CVE-2026-79804
Immediate Actions Required
- Restrict public access to /search.php at the reverse proxy or WAF until code fixes are in place.
- Rotate database credentials used by the application and audit the account's privileges to enforce least privilege.
- Review recent access and database logs for evidence of injection attempts or unauthorized data reads.
Patch Information
No vendor patch is available. The project uses a rolling release model, and the vendor did not respond to disclosure. Operators should apply source-level fixes by replacing string concatenation in /search.php with parameterized queries using PDO or mysqli prepared statements, and validate that search_box input matches an expected character set before use.
Workarounds
- Place the application behind a WAF configured with SQL injection rulesets that inspect the search_box parameter.
- Apply input allow-lists at the application layer to reject non-alphanumeric characters in search terms.
- Reduce database account permissions so the application user cannot read system tables or modify schema objects.
# Example ModSecurity rule to block SQL metacharacters in search_box
SecRule ARGS:search_box "@rx (?i)(union(\s|/\*.*?\*/)+select|--|;|/\*|\bor\b\s+1=1|sleep\s*\()" \
"id:1026798041,phase:2,deny,status:403,log,msg:'CVE-2026-79804 SQLi attempt on /search.php'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
