CVE-2026-127284SourceCodester Food Ordering System Admin Write add_category.php sql injection

Descripción

A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• VDB-436450 | SourceCodester Food Ordering System Admin Write add_category.php sql injection vdb-entrytechnical-description
• VDB-436450 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• CVE-2026-127284 | CVE Analysis and Report third-party-advisory
• Submit #1041049 | SourceCodester Food Ordering System in PHP and MySQL 1.0 SQL Injection third-party-advisory
• https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F2-Unauth… broken-linkexploit
• https://www.sourcecodester.com/ product