| Titel | projectworlds Online Ordering Food System 1.0 SQL Injection |
|---|
| Beschreibung | During the white-box testing of the Online-Food-Ordering-System-Project-in-PHP, it was found that the user input parameter "status" in the all-orders.php file is not filtered or processed and is directly concatenated into the SQL query statement, resulting in an SQL injection vulnerability. This allows attackers to exploit the vulnerability to insert malicious SQL statements and unauthorizedly tamper with or delete database information. The code here should be modified immediately to improve the security of the system. |
|---|
| Quelle | ⚠️ https://github.com/Duo-zhen/CVE/issues/4 |
|---|
| Benutzer | HaiYing (UID 91395) |
|---|
| Einreichung | 09.10.2025 14:31 (vor 8 Monaten) |
|---|
| Moderieren | 10.10.2025 15:00 (1 day later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 327926 [projectworlds Online Ordering Food System 1.0 /all-orders.php Status SQL Injection] |
|---|
| Punkte | 20 |
|---|