An unauthenticated SQL injection vulnerability in the Simple Food Order System 1.0 allows remote attackers to compromise the underlying database and potentially achieve full system control.

This is a SQL injection vulnerability (CWE-89) located in the all-orders.php file. The application fails to sanitize the status parameter before using it in SQL queries, allowing an unauthenticated remote attacker to execute arbitrary database commands.

Successful exploitation of this vulnerability permits unauthorized access to sensitive application data, including potential user credentials, order history, and administrative information. Given the CVSS score of 7.3, this flaw poses a high risk to business operations, as it enables data exfiltration, unauthorized modification of records, and potential service disruption. The ability for an unauthenticated user to interact directly with the database significantly lowers the barrier for malicious actors.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application and implement strict input validation on the status parameter.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected use of SQL syntax (e.g., UNION, SLEEP, or boolean-based blind injection patterns) originating from the all-orders.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and malicious payloads targeting URL parameters.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

The vulnerability represents a significant security risk due to its unauthenticated nature and the existence of a public proof-of-concept. Organizations utilizing Simple Food Order System 1.0 must treat this as a high-priority issue. Until a formal vendor patch is released, administrators should prioritize network isolation and the deployment of WAF rules to mitigate the risk of unauthorized database manipulation.