CVE-2026-4470
Published: 20 March 2026
Summary
CVE-2026-4470 is a medium-severity Injection (CWE-74) vulnerability in Adonesevangelista Online Frozen Foods Ordering System. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4470 is a SQL injection vulnerability (CWE-74, CWE-89) in the itsourcecode Online Frozen Foods Ordering System version 1.0. The issue affects an unknown functionality within the file /admin/admin_edit_menu.php, where manipulation of the product_name argument triggers the injection.
The vulnerability is exploitable remotely over the network with low attack complexity but requires high privileges (PR:H) and no user interaction. Per its CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L), a successful attack enables an authenticated administrative attacker to achieve low impacts on confidentiality, integrity, and availability through SQL injection.
Advisories and details are documented in references including a GitHub issue at https://github.com/sjkdhl/public/issues/3, the vendor site at https://itsourcecode.com/, and VulDB entries at https://vuldb.com/?ctiid.351760, https://vuldb.com/?id.351760, and https://vuldb.com/?submit.772882. The exploit has been publicly released, facilitating potential attacks.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13565
Vulnerability details
A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_name results in sql injection. It is possible…
more
to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in remotely accessible web admin interface directly enables exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation mechanisms for inputs like the product_name argument in /admin/admin_edit_menu.php.
Mandates identification, reporting, and correction of the specific SQL injection flaw in the vulnerable application code.
Vulnerability scanning identifies the SQL injection issue in the Online Frozen Foods Ordering System for timely remediation.