CVE-2026-76049

The CVSS 7.3 score for this SQL injection in SourceCodester Simple Online Food Ordering System materially understates actual risk. The scoring treats /admin/ajax.php?action=save_menu as an authenticated endpoint, but this assumption fails for the deployment ecosystem this codebase targets. SourceCodester applications are downloaded and deployed by operators—often small restaurants or startups—who want functional code, not security-hardened systems. The admin panel is typically left at its default path, credentials are never changed from installation defaults, and operators frequently don't even recognize /admin/ as a security boundary rather than just a menu management interface. Treat any internet-facing SourceCodester deployment as effectively unauthenticated until proven otherwise. The food ordering context changes the risk calculus significantly. These systems process customer names, addresses, phone numbers, and—critically—payment card data. This places them within PCI-DSS scope, meaning a successful SQL injection isn't just data leakage; it's a compliance failure with direct consumer harm. The CVSS framework doesn't encode this business context. Worse, the injection point is in the admin panel, but payment data flows through the ordering system. If the database layer shares privileges between ordering and admin functions—with no privilege separation, as is typical in this codebase family—an attacker may not need admin access at all to reach cardholder data. This is a different attack surface than the CVE description implies, and it suggests the actual path to sensitive data may be simpler than the score indicates. The phrase 'may be used' in the disclosure is a behavioral signal worth treating seriously: this language correlates with CVE disclosures from periods when operationalized exploits already existed in criminal tooling. The economic logic is straightforward—criminals don't automate exploitation of low-value targets. The existence of a working exploit suggests the target category has worth. The deeper problem is structural: SourceCodester applications ship into a maintenance vacuum. Authors routinely disappear after posting, leaving no patch pathway. For organizations running this software, the CVSS clock doesn't start a countdown to remediation—it starts a permanent exposure state with no endpoint. Standard vulnerability management workflows don't apply here. The operative question isn't 'how quickly can we patch?' but 'why are we running unremediable trialware that processes payment data in the first place?'

Reviewed through automated stages and approved by a human before publication.