CVE-2026-30530 - Vulnerability Analysis

Overview

SourceCodester Online Food Ordering System v1.0 contains a sql injection caused by improper sanitization of the "username" parameter in Actions.php save_customer action, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or full database compromise.

Mitigation

Update to the latest version with proper input sanitization or apply patches to fix SQL injection in Actions.php.

References

• https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/SQLi-Actions-saveCustomer-username.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner