cyberresearch.us

TLP:CLEAR confidence:low · #cyber-news #CVE-2026-76048 #CVE-2026-76049 #emerging

CVE-2026-76049 | SourceCodester Simple Online Food Ordering System 1.0

Luke Johnson / Cyber Research US

Summary

Public VulDB reporting describes three remotely reachable SQL injection flaws in SourceCodester Simple Online Food Ordering System 1.0, all in /admin/ajax.php (CVE-2026-76048 login username; CVE-2026-76049 save_menu ID; CVE-2026-76050 delete_menu ID). VulDB rates them critical, says they can be triggered over the network, and states an exploit is available for each. This memo is a synthesis of those RSS write-ups only; it is not independent reverse engineering, and the sources do not claim confirmed victim compromise.

Attack vector

The reported surface is the admin AJAX endpoint /admin/ajax.php on a network-exposed instance of Simple Online Food Ordering System 1.0 (scip VulDB). Attackers reach it remotely by invoking:

  • action=login and supplying a crafted Benutzername (username) argument (CVE-2026-76048)
  • action=save_menu and supplying a crafted ID argument (CVE-2026-76049)
  • action=delete_menu and supplying a crafted ID argument (CVE-2026-76050)

HTTP method, required cookies/session, and whether save_menu / delete_menu need a prior admin login are not stated. Preconditions beyond network reachability of that PHP endpoint are not stated.

Exploit

Bug class is SQL injection via unsanitized request arguments into an unspecified function behind those action= handlers (scip VulDB). Abuse is described only as manipulating username (login) or ID (save_menu / delete_menu) with “unknown data.” No query shape, DBMS, quote/escaping behavior, stacked-query vs. UNION vs. boolean/time-based technique, auth-bypass chain, or tool names are given. VulDB asserts a public exploit exists but does not include a payload or PoC in these articles.

In the wild / novelty

Not stated as exploited in the wild. The articles distinguish only disclosure plus “an exploit is available,” which is PoC/exploit-code availability, not honeypot hits or confirmed victims. No campaign, timeline beyond the CVE labels, or reporter other than VulDB is given.

Risk

If the injections work as labeled, a remote attacker can interfere with backend SQL on the food-ordering app’s database: credential or session data via the login handler, and menu-record integrity via save/delete ID handlers. Blast radius is the application database and any privileges of the DB user the PHP app uses; identities at risk are admin/customer records stored there. Failure mode if successful is typical SQLi (read, modify, or destroy data; possible further compromise only if the DB/OS privilege model allows it—not described). Affected population is deployments of this SourceCodester 1.0 sample app, not a named enterprise product line.

Remediation

No vendor patch, version fix, WAF rule, or hunting artifact is provided in the sources. Defenders who run this codebase should treat /admin/ajax.php login, save_menu, and delete_menu as untrusted-input sinks: parameterized queries for username and ID, restrict admin AJAX to authenticated sessions, and remove or isolate internet-facing copies of the 1.0 demo. Validate by confirming those parameters never concatenate into SQL and by reviewing web/DB logs for anomalous action=login|save_menu|delete_menu traffic—without relying on IOCs, which are not published here.

CVE / identifiers

CVE-2026-76048, CVE-2026-76049, CVE-2026-76050 (scip VulDB). No CWE or vendor advisory ID stated.

Confidence

low — single-feed VulDB templates agree with each other but give almost no implementation detail; exploit availability is asserted, not demonstrated in-article.

Open questions

Whether save_menu/delete_menu require authentication; HTTP verb and parameter binding (query vs. body); exact SQL statements and database engine; what the “available exploit” actually does; patch or fixed version; any real-world exploitation.

Sources