CVE-2026-5019: SQL Injection in Simple Food Order System

CVE-2026-5019 is a high severity (CVSS 7.3) SQL injection in code-projects Simple Food Order System 1.0. The Status parameter handled by all-orders.php reaches a database query unsafely, and the record says an exploit is public. No fixed version is named, so restrict access and use prepared statements.

What's affected

• Product: code-projects Simple Food Order System, version 1.0.
• File and parameter: all-orders.php, argument Status.
• Fixed version: none stated in the record. Check the project site for a patched release.
• Weaknesses: CWE-89, SQL injection, and CWE-74, injection.
• CVSS 7.3 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
• Published 29 March 2026. Not marked as exploited in CISA KEV, though the record says the exploit has been made public.

How to check if you're exposed

There is no package to query for a downloaded sample project, so check the code and the host.

grep -R "all-orders.php" /var/www 2>/dev/null
grep -n "\$_GET\|\$_POST\|\$_REQUEST" /var/www/**/all-orders.php 2>/dev/null

If the file exists on a server you run, the application is present. Look at how the Status value reaches the database query. If it is concatenated into the SQL text, the flaw is there. Also search web logs for requests to that file with unusual values in Status.

What to do now

1. Take the application off any public server unless you truly need it, or put it behind a login and an IP allowlist.
2. Replace string-built SQL with prepared statements and bound parameters, and validate the value against the expected set.
3. Give the database account used by the application only the permissions it needs, and never a root or admin account.
4. Check the vendor or project site for a patched version, and note that the CVE record names none.
5. Review database contents and web logs for signs of misuse, and restore from a clean backup if anything looks wrong.

Why it matters

SQL injection happens when user input is pasted into a query as text, so the database cannot tell data from commands. The record gives the class as CWE-89 and the wider injection family CWE-74. The cure is old and reliable: prepared statements with bound parameters.

Sample projects from tutorial and code-sharing sites are often written to teach, not to run in production. If one made it onto a real server, that is the first risk to remove.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.

Quick check

Sources

• code-projects.org (named in the record)
• Safeguard Gold entry

Last reviewed: 19 October 2026.