A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/view_prod.php, where manipulation of the 'ID' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected function within the file is currently unspecified. The vulnerability has been catalogued under CVE-2026-78199 and is tracked on NVD, VulDB, and GitHub. Organizations using this software should apply patches or mitigations immediately given the public exploit availability.