| tiêu đề | SourceCodester Online Food Ordering System 1.0 SQL Injection |
|---|
| Mô tả | The Online Food Ordering System distributed by SourceCodester contains a potential SQL injection vulnerability in category-foods.php.
The application reads the id parameter from the HTTP GET request and incorporates its value directly into an SQL query without using a parameterized statement.
During testing against a local installation, Boolean true and false conditions supplied through the id parameter produced different application responses. Malformed inputs also produced SQL syntax errors. These observations are consistent with SQL injection.
The issue could allow an attacker to alter the intended database query. The actual impact depends on the database permissions and query context. Unauthorized data extraction, database modification, and privilege escalation have not been verified.
The exact affected product version has not been independently confirmed. Testing was performed in a local lab environment. |
|---|
| Nguồn | ⚠️ https://gist.github.com/shamillshaanuh/33b32a9b7b21dd7b033d1cd0a30da593 |
|---|
| Người dùng | MUHAMMED SHAMIL (UID 102105) |
|---|
| Đệ trình | 13/10/2026 11:34 (cách đây 23 ngày) |
|---|
| Kiểm duyệt | 04/11/2026 19:25 (22 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 403411 [SourceCodester/katojkalemba Online Food Ordering System 1.0 /web/category-foods.php id Tiêm SQL] |
|---|
| điểm | 0 |
|---|