The SourceCodester Online Food Ordering System v1.0 contains an SQL injection flaw that allows authenticated attackers to compromise the backend database.

This is an SQL injection vulnerability located in the Actions.php file, specifically within the save_user action. The application fails to sanitize input provided to the username parameter, which permits an authenticated user to perform unauthorized database operations.

Successful exploitation of this vulnerability allows an attacker to manipulate, extract, or destroy sensitive data stored within the database. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full loss of confidentiality, integrity, and availability for the application. Such a breach may result in significant data exposure and potential regulatory non-compliance.

Immediate Action: Since no official vendor patch is currently available, administrators should restrict access to the affected module or disable the save_user functionality if it is not business-critical.

Proactive Monitoring: Review database audit logs for anomalous query patterns, particularly those involving unexpected syntax or unauthorized access attempts to user tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the identified username parameter.

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up hosted on GitHub.

Due to the lack of an official patch, organizations using the SourceCodester Online Food Ordering System v1.0 must treat this as a high-priority security risk. Implement strict input sanitization and parameterization at the application level if source code access is available, or isolate the system from untrusted networks until a formal fix is released by the vendor.