CVE-2026-5019: code-projects Simple Food Order System: SQL injection in all-orders.php Status parameter
A SQL injection vulnerability (CWE-74) in code-projects Simple Food Order System 1.0 involves the Status argument handled by all-orders.php. The record states it can be triggered remotely and that a public exploit has been disclosed, and NVD lists a CVSS base score of 9.8. CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted.
Overview
The record describes an SQL injection flaw (CWE-74, Injection) in the Status argument processed by all-orders.php in code-projects Simple Food Order System 1.0. The description places the issue in the Parameter Handler component and states that it can be initiated remotely. A public exploit has been disclosed according to the record.
Impact
- SQL injection can allow data exposure, modification or deletion in the application database, depending on the database permissions in use (inference).
- NVD assigns a base score of 9.8 (critical) with high confidentiality, integrity and availability impact in its vector.
- Other providers in the record list lower scores, from 5.5 to 7.5, under different scoring systems.
Affected products and versions
- Code-projects Simple Food Order System, version 1.0.
- Carmelo Simple Food Order System, version 1.0 (listed separately in the record; the relationship to the code-projects product is not explained).
- The record does not provide a fixed version.
Exploitation status
- The record states that the exploit has been disclosed publicly and may be used. SSVC data in the record marks exploitation as proof of concept and automatable.
- This CVE is not listed in CISA KEV. No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- No vendor fix is identified in the record. The listed fix entry is of type mitigation and points to a third-party issue tracker entry: GitHub issue 17.
- Restrict network access to the application administration and order management pages until the code is reviewed.
- Review the handling of the Status parameter and adopt parameterized queries or prepared statements, validating inputs against an allow list (general secure development practice).
- Apply least privilege to the database account used by the application.
Detection guidance
- Review web server and application logs for unusual or malformed values in the Status parameter of all-orders.php, and for database errors tied to that endpoint.
- Monitor for unexpected bulk reads or changes in order tables.
- Consider web application firewall rules that flag SQL metacharacters in that parameter as a temporary, non-definitive control.
Limitations of the available information
- The record does not include a vendor advisory, a fixed version or a confirmed patch.
- The relationship between the two listed product names is not explained.
- The EPSS entry contains a date that does not align with the publication timeline, so it is not used for analysis here.
- Technical details of the vulnerable code path are limited to the summary in the record and the cited third-party entries.
Frequently asked questions
What is the vulnerability in CVE-2026-5019?
According to the record, the Status argument handled by all-orders.php in code-projects Simple Food Order System 1.0 is vulnerable to SQL injection, and it can be triggered remotely.
Is this CVE being actively exploited?
The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record states that a public exploit has been disclosed.
Is there a fixed version?
The record does not identify a fixed version. It lists a mitigation reference from a third-party issue tracker, so administrators should consult the vendor and that entry for current guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.