CVE-2026-4319 is a SQL injection flaw (CVSS 7.3, high) in code-projects Simple Food Order System 1.0. The price argument of the file routers/add-item.php is not handled safely, and the attack can be launched remotely. The record lists no vendor fix, so replace the code or patch the query yourself.
What's affected
The NVD record names Simple Food Order System 1.0 from code-projects and the file /routers/add-item.php, with the price argument as the injectable input. It says the exploit has been made public. That means a proof of concept was disclosed, and it is not a statement that attacks are happening.
No fixed version is given in the record. I did not retrieve the vulnerability database entries it references.
How to check if you're exposed
- Find out whether this application runs anywhere in your estate, including test servers and student or demo deployments.
- Search the code for add-item.php and for queries that build SQL by joining strings with request values.
- Check whether the application is reachable from the internet.
- Review web logs for odd values in the price parameter of requests to add-item.php.
What to do now
- Take the application off the public internet if it is not needed.
- Change the query to use parameterized statements, and validate that price is a number before use.
- Run the database account with the least rights the app needs.
- Put a web application firewall in front of it as a stopgap.
- Plan a move to a maintained application, since the record shows no vendor fix.
Why it matters
The record lists CWE-89, SQL injection, and CWE-74, injection in general. Input that should be a number is placed into a SQL statement as text, so an attacker can change the meaning of the query. Reading or changing order data is the usual result.
The cause is old and well understood. Parameterized queries separate data from SQL and remove the problem. The KEV flag is false.
Quick check
Does the public exploit mean this is attacked in the wild?
No. The record says an exploit is public, which raises the risk, but it does not report exploitation. KEV is false.
Sources
Last reviewed: 19 October 2026.
