Overview
A SQL injection vulnerability has been disclosed in SourceCodester/katojkalemba Online Food Ordering System 1.0, a PHP/MySQL restaurant ordering script distributed on SourceCodester. Tracked as CVE-2026-90854, the flaw lives in an unknown function of /web/category-foods.php, where the ID argument is passed into a SQL query without sanitization. The attack can be launched remotely without authentication, and a public exploit is already circulating.
The same codebase carries a closely related flaw, CVE-2026-90855, affecting the ID parameter in /web/order.php — administrators running this application should treat both as in scope for remediation.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-90854 |
| CWE | CWE-89 (SQL Injection) |
| Severity | High (CVSS 3.x 7.3) |
| Attack Vector | Network |
| Privileges Required | None |
| Vulnerable File | /web/category-foods.php |
| Vulnerable Parameter | ID |
| Exploit Availability | Public exploit released |
| Assigner | VulDB |
How It Works
category-foods.php accepts an ID value — used to look up food items belonging to a given category — and concatenates it directly into a SQL statement instead of using a parameterized query or prepared statement. An attacker who submits a crafted ID value can alter the query's logic to read, and potentially modify, data far outside the intended category lookup, including tables that were never meant to be reachable from this endpoint.
Because the endpoint requires no authentication and the attack can be carried out with a single crafted HTTP request, exploitation requires no special access or user interaction.
Impact Assessment
| Impact Area | Description |
|---|---|
| Data Confidentiality | Attacker-controlled queries can extract arbitrary rows from the application database, including customer orders, account records, and admin credentials if stored in-band |
| Data Integrity | Depending on the underlying query and database permissions, UNION- or stacked-query-based injection could allow data modification |
| Availability | Malformed queries could degrade or crash the database backend under sustained abuse |
| Attack Complexity | Low — no authentication or user interaction required, and a public exploit already exists |
This is a low-quality, template-style PHP application typically deployed by small businesses or as a learning project rather than an enterprise platform — but that also means it is frequently deployed with default configurations and rarely patched once put into production.
Mitigation
- Apply a vendor patch or update if one becomes available. No fixed version was referenced in the disclosure at the time of writing — check the SourceCodester listing for the katojkalemba fork before continuing to run 1.0 in production.
- Rewrite the vulnerable query using parameterized statements (e.g., PDO prepared statements) if you maintain a fork of this codebase in-house.
- Do not expose this application to the public internet without a web application firewall in front of it capable of blocking SQL injection payloads.
- Audit
/web/order.phpas well, given the related CVE-2026-90855 affects the sameID-parameter pattern. - Review database logs for anomalous
category-foods.phprequests containing SQL syntax (UNION,OR 1=1, comment sequences) to check for prior exploitation. - Consider migrating off unmaintained SourceCodester-distributed scripts for any deployment handling real customer or payment data.