Login Request a demo
Critical severity · published Jan 23, 2025
CVE-2024-57328
A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The vulnerability arises because the input fields username and password are not properly sanitized, allowing attackers to inject malicious SQL queries to bypass authentication and gain unauthorized access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Online Food Ordering System · Projectworlds
1.0 · source: NVD
Affected product
OF
Online Food Ordering System
Projectworlds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-57328
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-57328
Exploit
https://github.com/fatihtuzunn/CVEs/tree/main/CVE-2024-57328
More from Online Food Ordering System
9.8
CVE-2026-2136
projectworlds Online Food Ordering System view-ticket.php sql injection
9.8
CVE-2025-11604
projectworlds Online Ordering Food System all-orders.php sql injection
9.8
CVE-2025-4936
A vulnerability was found in projectworlds Online Food Ordering System 1.0
9.8
CVE-2023-45344
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities
9.8
CVE-2023-45343
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities