CVE-2023-40748

CRITICALNuclei

phpjabbers food_delivery_script Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-40748 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 25, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

food_delivery_script

Browse phpjabbers / food_delivery_script
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALPHPJabbers Food Delivery Script - SQL InjectionCVSS 9.8

PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.

Impact

Unauthenticated attackers can exploit SQL injection in the q parameter to extract sensitive database information including customer orders, payment details, delivery addresses, and admin credentials from the Food Delivery platform.

Remediation

Update PHPJabbers Food Delivery Script to a version newer than 3.0 that properly sanitizes the q parameter and uses parameterized queries.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscvecve2023phpjabbersfood-deliverysqlivulnvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:phpjabbers:food_delivery_script:3.0:*:*:*:*:*:*:*
Shodan: html:"PHPJabbers"
https://medium.com/@tfortinsec/multiple-vulnerabilities-in-phpjabbers-part-3-40fc3565982f https://nvd.nist.gov/vuln/detail/CVE-2023-40748

Source: ProjectDiscovery

References

4