CVE-2026-30529 - Vulnerability Analysis

Overview

SourceCodester Online Food Ordering System v1.0 contains a sql injection caused by improper sanitization of the "username" parameter in Actions.php save_user action, letting authenticated attackers execute arbitrary SQL commands.

Severity & Score

Impact

Authenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version or apply patches that sanitize user input properly.

References

• https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/SQLi-Actions-saveUser-username.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner