A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

A SQL injection vulnerability has been discovered in the SourceCodester/katojkalemba Online Food Ordering System version 1.0. The flaw exists in an unknown function within the file /web/category-foods.php, where manipulation of the 'ID' argument leads to SQL injection. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The issue is tracked under CVE-2026-90854 and has been assigned a high criticality rating. Attackers could potentially access, modify, or delete database contents through this vulnerability. Users of the affected system are advised to apply patches or mitigations as soon as possible.