CVE-2026-90854 Overview
CVE-2026-90854 is a SQL injection vulnerability in SourceCodester/katojkalemba Online Food Ordering System 1.0. The flaw resides in an unspecified function within /web/category-foods.php. Attackers can manipulate the ID parameter to inject arbitrary SQL statements against the backend database. Exploitation requires no authentication and can be performed remotely over the network. Public exploit code has been released, increasing the risk of opportunistic attacks against exposed installations. The weakness is classified as [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).
Critical Impact
Unauthenticated remote attackers can inject SQL to read, modify, or destroy data in the Online Food Ordering System database.
Affected Products
- SourceCodester/katojkalemba Online Food Ordering System 1.0
- Vulnerable component: /web/category-foods.php
- Vulnerable parameter: ID
Discovery Timeline
- 2026-09-15 - CVE-2026-90854 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90854
Vulnerability Analysis
The /web/category-foods.php endpoint accepts an ID value from the client and passes it into a SQL query without proper sanitization or parameterization. An attacker supplies crafted input to alter the structure of the underlying query. This allows extraction of arbitrary rows, boolean-based or time-based data inference, and potentially write operations depending on database privileges. According to the referenced VulDB entry, working exploit details have been publicly released. The EPSS model reports a low near-term exploitation probability, but the presence of a public exploit lowers the bar for unskilled attackers to weaponize the flaw. Data confidentiality, integrity, and availability are all impacted at a limited scale, consistent with the CVSS 4.0 vector reported by NVD.
Root Cause
The root cause is the direct concatenation of the user-controlled ID parameter into a SQL statement executed by the PHP handler. No prepared statements, bound parameters, or input validation are used to constrain the value to an integer identifier. This falls under [CWE-74] Injection, specifically the SQL injection subclass.
Attack Vector
An unauthenticated remote attacker issues an HTTP request to /web/category-foods.php with a malicious ID value. The manipulated parameter breaks out of the intended SQL context and executes attacker-controlled clauses. No user interaction is required. Because the endpoint is reachable over the network on any exposed deployment, mass scanning and automated exploitation are practical.
No verified proof-of-concept code is reproduced here. Technical details are referenced in the VulDB entry for CVE-2026-90854 and VulDB Vulnerability #403411.
Detection Methods for CVE-2026-90854
Indicators of Compromise
- HTTP requests to /web/category-foods.php containing SQL metacharacters in the ID parameter, such as single quotes, UNION SELECT, SLEEP(, --, or /* sequences.
- Web server or database error messages referencing SQL syntax errors originating from category-foods.php.
- Unusual outbound queries or spikes in database CPU tied to requests against the category-foods endpoint.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the ID query parameter on /web/category-foods.php for SQL injection payload signatures.
- Enable database query logging and alert on parameterization anomalies or repeated syntactically invalid queries from the application service account.
- Correlate web access logs with database audit trails to identify request-to-query pairs that read outside the expected category tables.
Monitoring Recommendations
- Monitor HTTP 500 responses and long request durations originating from /web/category-foods.php, which can indicate time-based blind SQL injection attempts.
- Track authentication-free access patterns targeting the Online Food Ordering System and alert on non-browser user agents at high request rates.
- Review database accounts used by the application for unexpected privilege use, such as INFORMATION_SCHEMA enumeration.
How to Mitigate CVE-2026-90854
Immediate Actions Required
- Restrict public network access to the Online Food Ordering System until a fixed release is available, using firewall rules or reverse-proxy allowlists.
- Deploy WAF rules that block SQL injection patterns targeting the ID parameter on /web/category-foods.php.
- Rotate database credentials and audit database contents for unauthorized modification.
Patch Information
No vendor patch has been published in the referenced advisories at the time of NVD publication. Consult the VulDB CVE-2026-90854 entry and the upstream SourceCodester project for updates.
Workarounds
- Modify /web/category-foods.php to cast the ID parameter to an integer before use, or replace the query with a prepared statement using bound parameters.
- Apply the principle of least privilege to the database account used by the application, removing write and schema-inspection permissions where not required.
- Place the application behind an authenticated reverse proxy while remediation is in progress to limit unauthenticated exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
