The Simple Food Order System 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the add-item.php file. It occurs because the application fails to sanitize or validate the price parameter before incorporating it into SQL queries, allowing an unauthenticated attacker to manipulate database operations.

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database, potentially leading to the leakage of sensitive data, unauthorized modification or deletion of records, and total system compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and loss of data integrity.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable add-item.php functionality until a fix can be implemented.

Proactive Monitoring: Security teams should monitor web access logs for suspicious POST requests to add-item.php, specifically looking for SQL syntax patterns or time-based delay signatures consistent with SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and restrict input to the price parameter to numeric values only.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

The presence of a publicly available proof-of-concept significantly increases the risk of exploitation by malicious actors. Organizations currently running Simple Food Order System 1.0 must prioritize the implementation of compensating controls or isolate the application from external networks to prevent unauthorized data access. If the software is no longer maintained, consider migrating to a more secure and supported alternative.