External risk intelligence

SourceCodester Online Food Ordering System SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-30532

The vulnerability exists in an Online Food Ordering System, which is typically deployed as a public-facing web application to allow customers to view products and place orders. Because these systems are designed to be accessible to the public internet for business operations, the vulnerable component is likely to be reachable by external users.

SQL Injection

Oretnom23 Online Food Ordering System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical SQL injection vulnerability found in a specific version of an online food ordering system. This type of flaw can allow unauthorized access to and manipulation of sensitive data within the system if exploited. The primary concern is to confirm if this particular software is in use within the organization's environment.

System flaw allows unauthorized data access.
Critical vulnerability impacts public-facing systems.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a SQL injection flaw in the Online Food Ordering System by targeting the "id" parameter within the "view_product.php" file. This allows them to manipulate database queries, potentially leading to unauthorized access and modification of sensitive information.

No authentication required.
Manipulate the "id" parameter.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

A SQL Injection vulnerability in the product viewing component of an online food ordering system could allow an unauthenticated attacker to manipulate database queries. This could potentially lead to unauthorized access to or modification of system data when the system is accessible via a network.

System data and database integrity.
Via crafted network requests to the product view.
Database compromise and unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the Online Food Ordering System requires action from teams managing web applications and their underlying infrastructure. The first step is to identify all instances of this system, confirm their accessibility from the internet, and determine which are business-critical. Once the accountable owner is identified, remediation can be planned based on the assessed risk.

Identify asset owners for web applications.
Verify external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SourceCodester Online Food Ordering System?

It is a web-based platform developed by oretnom23, designed to help businesses manage food menus, product displays, and customer order processing. Users typically deploy this software to provide an interactive interface where customers can browse food items and submit orders online.

How does this SQL injection vulnerability work in CVE-2026-30532?

This flaw belongs to the CWE-89 weakness class, which happens when software fails to properly sanitize user input before including it in database commands. In this specific case, the system allows an attacker to inject malicious SQL code through the 'id' parameter in the 'view_product.php' file, potentially granting them unauthorized control over the database.

Does the attacker need to log in to trigger this SQL injection?

No, this vulnerability does not require authentication. An attacker can reach the flaw simply by sending a crafted network request to the vulnerable 'view_product.php' file. Requests that do not interact with the specific 'id' parameter or attempts directed at non-existent pages will not trigger this particular injection flaw.

Is my system at risk if it runs this software?

Halo Surface Signal indicates that because this is an online food ordering system intended for public business operations, it is likely deployed as an internet-facing application. Systems exposed to the public internet are at a much higher risk of being reached by unauthorized users compared to those restricted to internal, private networks.

What should I do first if I am running this software?

Your first step is to locate all instances of this specific ordering system within your environment. Once identified, confirm whether these applications are reachable from the internet and evaluate their business criticality. After assessing these factors, you can coordinate with the appropriate system owners to plan and prioritize your next steps for risk reduction.

References

github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Orde…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.