CVE-2026-26713

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-26713", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-03T15:21:06.155Z", "dateReserved": "2026-02-16T00:00:00.000Z", "datePublished": "2026-03-02T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-02T19:17:52.217Z"}, "descriptions": [{"lang": "en", "value": "code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/Thirtypenny77/bug_report/blob/main/code-projects/simple-food-order-system/SQL-4.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T15:20:15.547053Z", "id": "CVE-2026-26713", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:21:06.155Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-26713", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T15:20:15.547053Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T15:20:57.732Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/Thirtypenny77/bug_report/blob/main/code-projects/simple-food-order-system/SQL-4.md"}], "descriptions": [{"lang": "en", "value": "code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-02T19:17:52.217Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26713", "state": "PUBLISHED", "dateUpdated": "2026-03-03T15:21:06.155Z", "dateReserved": "2026-02-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-02T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:carmelo:simple_food_order_system:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "241FC05F-317E-46C5-B9C7-A3A53DD97B63", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php."}, {"lang": "es", "value": "code-projects Simple Food Order System v1.0 es vulnerable a inyecci\u00f3n SQL en /food/routers/cancel-order.PHP."}], "id": "CVE-2026-26713", "lastModified": "2026-06-17T10:26:15.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26713", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T15:20:15.547053Z", "version": "2.0.3"}}]}, "published": "2026-03-02T20:16:27.103", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Thirtypenny77/bug_report/blob/main/code-projects/simple-food-order-system/SQL-4.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "simple_food_order_system", "vendor": "code-projects"}], "analysis": {"en": {"generated_at": "2026-04-16T14:47:19.661396+00:00", "value": {"mitigation_remediation": ["Deploy the vendor\u2019s patched version of Simple Food Order System if one becomes available.", "If a patch is not yet released, modify the cancel\u2011order.php script to use parameterized queries (e.g., prepared statements) and sanitize all user\u2011supplied data.", "Restrict database permissions so that the application can only perform the necessary operations for order cancellation and nothing more.", "Disable or limit direct access to the cancel\u2011order.php endpoint for unauthenticated users, and enforce strong authentication and authorization checks."], "summary": {"action": "Patch Immediately", "impact": "High\u2011severity SQL Injection"}, "threat_synthesis": {"affected_systems": "The affected product is Simple Food Order System, version 1.0, distributed by code\u2011projects. The vulnerable component is the cancel\u2011order script located at /food/routers/cancel-order.php. No other versions or vendors are listed as affected.", "description_and_impact": "This vulnerability is a classic SQL injection flaw located in the cancel\u2011order handler of Simple Food Order System version 1.0. An attacker could inject malicious SQL statements that may read, modify, or delete database records, leading to full compromise of confidential order data, data integrity violations, and potential escalation of privileges if the database user has elevated rights. The weakness is identified as CWE\u201189, confirming the absence of proper input validation and parameterization.", "risk_and_exploitability": "The CVSS score is 9.8, indicating critical severity, although the EPSS score is reported as <1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely able to exploit the flaw by sending crafted requests to the cancel\u2011order endpoint, which may be reachable to any authenticated or unauthenticated user with network access to the application."}}}}, "created": "2026-03-03T08:46:23.058838+00:00", "title": "SQL Injection in Cancel Order Endpoint", "updated": "2026-04-16T15:00:14.305307+00:00", "vendors": ["code-projects", "code-projects$PRODUCT$simple_food_order_system"]}