A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

A SQL injection vulnerability has been identified in SourceCodester/katojkalemba Online Food Ordering System version 1.0. The vulnerability exists in the file /web/order.php, where manipulation of the 'ID' argument leads to SQL injection. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been released, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-90855 and has been reported via NVD and VulDB. No authentication bypass details are specified, but remote exploitability makes this a significant risk. Organizations using this software should apply patches or mitigations immediately. The availability of a public exploit elevates the urgency of remediation.