CVE-2026-4471
Published: 20 March 2026
Summary
CVE-2026-4471 is a medium-severity Injection (CWE-74) vulnerability in Adonesevangelista Online Frozen Foods Ordering System. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-4471 is a SQL injection vulnerability affecting itsourcecode Online Frozen Foods Ordering System version 1.0. The flaw exists in an unknown part of the file /admin/admin_edit_employee.php, where manipulation of the First_Name argument enables SQL injection. Published on 2026-03-20T05:16:16.857, it carries a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 74 (Improper Neutralization of Special Elements used in an SQL Command) and 89 (SQL Injection).
The vulnerability is exploitable remotely by attackers with high privileges, such as authenticated administrators. Exploitation allows limited impacts, including low-level confidentiality breaches (e.g., partial data disclosure), low integrity alterations (e.g., minor unauthorized modifications), and low availability disruptions (e.g., minor denial of service).
Advisories documented on VulDB (ctiid.351761, id.351761, submit.773939) confirm the remote SQL injection via the First_Name parameter, while a GitHub issue (https://github.com/microwaveabi/vul/issues/1) provides a publicly available exploit. The vendor site (https://itsourcecode.com/) is referenced, but no patches or specific mitigations are detailed in the available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13567
Vulnerability details
A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_employee.php. Executing a manipulation of the argument First_Name can lead to sql injection. It is possible to launch the…
more
attack remotely. The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a remotely accessible web admin interface (admin_edit_employee.php) directly enables exploitation of a public-facing application via crafted input to the First_Name parameter.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by validating and sanitizing the First_Name input parameter in /admin/admin_edit_employee.php.
Requires identification, reporting, and correction of the specific SQL injection flaw in the vulnerable file.
Enables vulnerability scanning to detect the SQL injection issue and trigger timely remediation.