CVE-2026-30531 - Vulnerability Analysis

Overview

SourceCodester Online Food Ordering System v1.0 contains a sql injection caused by improper sanitization of the "name" parameter in Actions.php save_category action, letting authenticated attackers execute arbitrary SQL commands.

Severity & Score

Impact

Authenticated attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version with proper input sanitization.

References

• https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/SQLi-Actions-saveCategory-name.md

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner