| 제목 | SourceCodester Online Food Ordering System 1.0 SQL Injection |
|---|
| 설명 | The Online Food Ordering System distributed by SourceCodester contains a potential SQL injection vulnerability in order.php.
The application reads the id parameter from the HTTP GET request and concatenates it directly into a SQL query used to retrieve a food record from tbl_food, without using a parameterized statement.
During testing against a local installation, Boolean true and false conditions supplied through the id parameter produced different responses. Malformed inputs also produced SQL syntax errors. These observations are consistent with SQL injection.
An attacker may be able to alter the intended database query. The practical impact depends on the query context, database permissions, and deployment configuration. Unauthorized data extraction, database modification, and privilege escalation have not been verified.
The exact affected release has not been independently confirmed. Testing was performed in a local lab environment. |
|---|
| 원천 | ⚠️ https://gist.github.com/shamillshaanuh/d176770d4b739b09b81262878195696d |
|---|
| 사용자 | MUHAMMED SHAMIL (UID 102105) |
|---|
| 제출 | 2026. 10. 13. AM 11:43 (23 날 ago) |
|---|
| 모더레이션 | 2026. 11. 04. PM 07:26 (22 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 403412 [SourceCodester/katojkalemba Online Food Ordering System 1.0 /web/order.php id SQL 주입] |
|---|
| 포인트들 | 0 |
|---|