PT-2026-28403 · Oretnom23 · Online Food Ordering System

Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-30530

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save customer action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an attacker to inject malicious SQL commands.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-30530

Affected Products

Online Food Ordering System

References · 2

• 🔥 https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/SQLi-Actions-saveCustomer-username.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30530 · Security Note