Submit #1041049: SourceCodester Food Ordering System in PHP and MySQL 1.0 SQL Injection

Unauthenticated SQL injection in the admin write handlers of SourceCodester Food Ordering System in PHP and MySQL 1.0 allows remote attackers to inject arbitrary SQL through several request parameters that are concatenated into INSERT/UPDATE statements without escaping.

Affected parameters (all reachable without a session because the shared session gate redirects without terminating execution): admin/add_category.php title (insert into tbl_category, title='$title'); admin/add_food.php description and price (price placed in numeric context without quotes); admin/update_food.php price (same numeric context); admin/update_category.php current_image, featured and active (concatenated into UPDATE) and the GET id in WHERE id = $id. Notably the same project escapes the login input and update_category's title with mysqli_real_escape_string, confirming the remaining raw parameters are defects rather than design choices.

CWE-89. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 (INSERT/UPDATE-context injection; conservative scoring; destructive extraction not executed).

Verified 2026-10-18: concatenation paths confirmed in shipped source; unauthenticated reachability confirmed (same non-terminating gate as the file-upload issue, reported separately).

Impact: unauthenticated creation/modification/corruption of category and food records and boolean/time-based probing for database extraction through the numeric price and id positions.

Remediation: prepared statements with bound parameters in all four handlers; cast numeric values; align with the escaping already present on the login path.

PoC:
curl -s -X POST "http://<TARGET>/web/admin/add_category.php" -d "submit=1&title=Test',featured=(select 1 from tbl_admin limit 1),active='No"
curl -s -X POST "http://<TARGET>/web/admin/update_category.php?id=1" -d "submit=1&title=Cat&current_image=x',active=(select 1),featured='No"

White-box audit by EVA Security Research (yuechuya), 2026-10-18. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md

• Quelle: ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth-SQL-Injection.md
• Benutzer: yuechuya (UID 101209)
• Einreichung: 18.10.2026 12:02 (vor 25 Tagen)
• Moderieren: 12.11.2026 18:39 (25 days later)
• Status: Akzeptiert
• VulDB Eintrag: 436450 [SourceCodester Food Ordering System 1.0 Admin Write admin/add_category.php SQL Injection]
• Punkte: 20