CVE-2026-90855: Online Food Ordering System SQL Injection

CVE-2026-90855 Overview

CVE-2026-90855 is a SQL injection vulnerability in SourceCodester/katojkalemba Online Food Ordering System 1.0. The flaw resides in /web/order.php, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the ID argument to inject arbitrary SQL statements. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). A public exploit has been referenced by VulDB, increasing the likelihood of opportunistic scanning and exploitation attempts against exposed instances.

Critical Impact
Unauthenticated remote attackers can read, modify, or delete backend database records by injecting SQL through the ID parameter in /web/order.php.

Affected Products

SourceCodester/katojkalemba Online Food Ordering System 1.0
Deployments exposing /web/order.php to untrusted networks
Forks or derivatives reusing the vulnerable order handler

Discovery Timeline

2026-09-15 - CVE-2026-90855 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90855

Vulnerability Analysis

The vulnerability is a classic SQL injection in the order.php endpoint of the Online Food Ordering System 1.0. The application accepts a user-supplied ID value from the HTTP request and concatenates it into a SQL statement executed against the backend database. Because no parameterized queries or input validation are applied, attackers can break out of the intended query context and append arbitrary SQL clauses. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Successful exploitation can expose customer records, order histories, and administrative credentials stored in the same database.

Root Cause

The root cause is improper neutralization of a request parameter used inside a SQL statement. The ID argument flows directly into the query string without prepared statements, bound parameters, or type coercion. This design allows metacharacters such as single quotes, UNION, and comment sequences to alter query logic.

Attack Vector

An attacker sends a crafted HTTP request to /web/order.php with a malicious value in the ID parameter. Standard SQL injection payloads, including boolean-based, error-based, and UNION-based techniques, can be used to enumerate the database schema and extract data. Automated tools such as sqlmap can weaponize the flaw quickly since no authentication barrier exists.

No verified proof-of-concept code has been published to this article. Refer to the VulDB entry for CVE-2026-90855 for additional technical detail.

Detection Methods for CVE-2026-90855

Indicators of Compromise

HTTP requests to /web/order.php containing SQL metacharacters such as ', ", --, #, or ; in the ID parameter.
Requests containing SQL keywords like UNION, SELECT, SLEEP, BENCHMARK, or INFORMATION_SCHEMA targeting the ID argument.
Web server logs showing abnormal response sizes or 500-series errors originating from order.php.
User-Agent strings associated with sqlmap or other automated injection tools.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns in query string parameters, particularly for /web/order.php?ID=.
Enable database query logging and alert on unexpected UNION SELECT or schema enumeration queries originating from the web application user.
Correlate web access logs with database errors to identify probing attempts.

Monitoring Recommendations

Monitor outbound traffic from the database host for unusual data volumes that could indicate exfiltration.
Track authentication failures and privilege changes in the application database following suspicious order.php requests.
Baseline normal request patterns to order.php and alert on parameter values that deviate from expected numeric identifiers.

How to Mitigate CVE-2026-90855

Immediate Actions Required

Restrict public access to the Online Food Ordering System 1.0 application until a fix is applied, using network ACLs or a reverse proxy.
Deploy WAF signatures that block SQL injection payloads targeting the ID parameter of /web/order.php.
Rotate database credentials and audit application database accounts for excess privileges.
Review web and database logs for prior exploitation attempts.

Patch Information

No official vendor patch has been referenced in the CVE record at time of publication. Administrators should modify order.php to use prepared statements with bound parameters and validate that ID is a strict integer before use. Track the VulDB vulnerability record for updates from the maintainer.

Workarounds

Rewrite the affected query in order.php to use parameterized statements via PDO or mysqli prepared statements.
Enforce server-side input validation that rejects any non-numeric value supplied for ID.
Apply the principle of least privilege to the database account used by the application, removing DROP, ALTER, and cross-database read permissions.
Consider retiring or replacing the application if the maintainer does not issue a fix, given the low complexity of exploitation.

bash

# Example WAF rule concept (ModSecurity-style) to block SQLi in the ID parameter
SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|information_schema|--|#|;)" \
    "id:1029085501,phase:2,deny,status:403,log,msg:'Possible SQLi against order.php ID parameter (CVE-2026-90855)'"