CVE-2026-30530

The application does not properly sanitize user input provided to the 'username' parameter in the save_customer action of the Actions.php file. The lack of filtering allows an attacker to inject arbitrary SQL commands into the query executed by the database server. The attack is possible remotely, without authentication and without user interaction, corresponding to a network vector with low complexity (AV:N/AC:L/PR:N/UI:N).

An attacker can gain unauthorized access to data stored in the database (confidentiality), modify or delete data (integrity), and potentially cause service unavailability or take control of the database server (availability).

Apply patches available from the vendor according to the references. As temporary measures, it is recommended to implement validation and parameterization of SQL queries (prepared statements), restrict access to the vulnerable endpoint at the firewall/WAF level, and monitor logs for anomalous queries.

SourceCodester Online Food Ordering System v1.0 (Actions.php file, save_customer action)