CVE-2026-116604 in Online Food Ordering System
Summary
by MITRE • 10/27/2026
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The SourceCodester Online Food Ordering System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the admin/delete_admin.php file. This vulnerability stems from an insufficient implementation of access control mechanisms for functions that handle sensitive administrative operations. The core technical issue involves the manipulation of the ID argument passed to this endpoint, which fails to enforce proper authentication checks before executing deletion commands. In a secure system design, any request targeting administrative user management must verify the identity and privileges of the requesting entity against established session tokens or credentials. However, in this instance, the application logic allows an unauthenticated actor to bypass these security controls by directly invoking the delete function with a valid administrator ID parameter. This represents a classic case of broken access control where the server trusts client-supplied input without validating whether the requester has the requisite permissions to perform such actions.
From a technical perspective, this flaw aligns closely with CWE-284 Improper Access Control and CWE-862 Missing Authorization. The vulnerability allows an attacker to remotely initiate attacks against the system's administrative users without needing valid login credentials for any account. By exploiting the missing authentication check on the delete_admin.php endpoint, a malicious actor can remove administrator accounts from the database. This capability effectively strips the legitimate administrators of their ability to manage the application, leading to a complete loss of control over the online food ordering platform. The remote nature of this exploit means that no physical access or prior compromise is required; an attacker only needs network connectivity to the vulnerable server and knowledge of at least one administrator's ID within the system.
The operational impact of this vulnerability is severe as it directly compromises the integrity and availability of the administrative functions. Once an administrator account is deleted, the remaining administrators may be locked out if they were the sole users with elevated privileges, or the application may become unstable depending on how cascading deletions are handled within the database schema. Furthermore, the ability to remove admin accounts can serve as a precursor to more destructive attacks, such as defacement of the public-facing website or manipulation of order data, since the security perimeter has been breached without detection through standard login attempts. The fact that this exploit is publicly disclosed increases the risk significantly, as automated scanners and opportunistic attackers will likely target systems running this specific version of the software to gain unauthorized control over their instances.
To mitigate this vulnerability, immediate remediation steps must focus on enforcing strict authentication and authorization checks at every administrative endpoint. Developers should implement session validation middleware that verifies active user sessions and role-based access permissions before processing any requests related to admin management. Specifically, the delete_admin.php script must check if the current authenticated user has super-administrator privileges and is not attempting to delete their own account without proper confirmation workflows. Additionally implementing rate limiting on administrative endpoints can help mitigate brute-force attempts or automated exploitation scripts. It is also recommended to review all other API endpoints within the application for similar access control flaws, as this issue often indicates a broader pattern of insecure design in legacy codebases like those found in SourceCodester projects. Upgrading to a patched version if available, or refactoring the authentication logic to follow OWASP Access Control guidelines, is essential for restoring security posture.