Online-food-ordering-system SQL Injection Vulnerability

gistfile1.txt

They include all external parameters directly in the sql query.

For example-1:

https://github.com/tourist5/Online-food-ordering-system/blob/main/all-tickets.php

if(isset($_GET['status'])){
  $status = $_GET['status'];
}
else{
  $status = '%';
}			
$sql = mysqli_query($con, "SELECT * FROM comments WHERE status LIKE '$status';");

You can exploit the parameter of $status.

Example-2:

https://github.com/tourist5/Online-food-ordering-system/blob/main/view-ticket.php

You can exploit $id parameter.