CVE-2026-5019: SQL Injection in code-projects Simple Food Order System (Orders)

CVE-2026-5019: SQL Injection in Simple Food Order System Orders Module

A SQL injection vulnerability tracked as CVE-2026-5019 has been disclosed in code-projects Simple Food Order System 1.0. The flaw resides in the /all-orders.php endpoint, where the Status parameter is passed directly into a SQL query without validation. The vulnerability is remotely initiatable and carries a CVSS v3.1 score of 7.3 (High), classified under CWE-89.

This is the third SQL injection CVE disclosed in the same application within a 24-hour window (alongside CVE-2026-5017 and CVE-2026-5018), underscoring a systemic lack of input validation throughout the code-projects Simple Food Order System codebase.

Vulnerability Overview

Technical Details

Affected Component

The vulnerability is in the order management module. The /all-orders.php endpoint accepts a Status parameter to filter orders by their fulfilment state (e.g., pending, completed, cancelled). This parameter is directly concatenated into a SQL query string without escaping or use of prepared statements.

Exploitation Mechanism

An attacker can manipulate the Status parameter to inject arbitrary SQL:

/all-orders.php?Status=1' OR '1'='1
/all-orders.php?Status=pending' UNION SELECT username,password,email,NULL FROM users--
/all-orders.php?Status=1'; UPDATE orders SET status='cancelled' WHERE '1'='1--

Potential exploitation outcomes include:

• Full order database dump — all order history, customer details, and fulfilment records
• Customer PII exposure — names, addresses, phone numbers associated with orders
• Inventory and pricing data — menu items, pricing structures, and stock levels
• Credential extraction — admin usernames and passwords from the users table
• Data manipulation — order status, pricing, and records can be modified or deleted

Attack Flow

1. Attacker discovers an internet-facing Simple Food Order System deployment

2. Attacker crafts a malicious Status parameter value targeting /all-orders.php

3. Server embeds the unsanitized value into a SQL query and executes it

4. Injected SQL returns database contents or modifies records as directed

5. Customer PII, order data, and admin credentials are exfiltrated

6. Attacker leverages extracted credentials for further access or sells data

Relationship to CVE-2026-5017 and CVE-2026-5018

This vulnerability was disclosed alongside two others affecting the same application:

The simultaneous disclosure of three SQL injection flaws in a single application version strongly suggests that the entire codebase was built without parameterized queries — any endpoint accepting user input should be treated as potentially vulnerable until a full audit is completed.

Remediation

Immediate Steps

1. Restrict the orders endpoint — Block /all-orders.php from public internet access
2. Deploy WAF rules — Enable SQL injection detection on all PHP endpoints
3. Audit the entire codebase — Given the pattern of three SQLi CVEs, every file with $_GET or $_POST usage should be reviewed
4. Implement prepared statements throughout the application — PDO is the recommended approach
5. Rotate all credentials — Treat all stored passwords as potentially compromised

Code-Level Fix

// Vulnerable pattern
$query = "SELECT * FROM orders WHERE Status = '" . $_GET['Status'] . "'";
 
// Secure pattern (PDO prepared statement)
$stmt = $pdo->prepare("SELECT * FROM orders WHERE Status = ?");
$stmt->execute([$_GET['Status']]);

Impact Assessment

Key Takeaways

1. CVE-2026-5019 is a CVSS 7.3 SQL injection in code-projects Simple Food Order System 1.0, in the orders listing module
2. The Status parameter in /all-orders.php is unsanitized, enabling database manipulation from remote attackers
3. This is the third SQL injection CVE disclosed in this application within 24 hours — the entire codebase should be considered unsafe for production
4. No official patch — restrict internet access to the application immediately
5. Operators should perform a full SQL audit of all PHP files in the project before any further use

Sources

• CVE-2026-5019 — NIST NVD