Security readout for executives and security teams
Plain-English summary
CVE-2023-24197 describes an input-handling flaw in Online Food Ordering System v2 at view_order.php. The reported issue is SQL injection through the id parameter, which could expose or alter limited data if a vulnerable deployment is reachable. Public metadata is inconsistent, so treat this as a moderate, source-code-level risk requiring verification.
Executive priority
Prioritize remediation if this code is public-facing or handles customer/order data. The issue is not KEV-listed and lacks confirmed active exploitation in the supplied sources, but copied PHP/MySQL apps often have weak patch visibility. Treat remediation as near-term hygiene, not an emergency without exposure evidence.
Technical view
The record reports SQL injection in view_order.php via id, with CVSS 3.1 score 6.1 and vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The bundle lists CWE-79, which conflicts with the SQL injection description. No affected CPEs, official patch, or vendor mitigation are provided.
Likely exposure
Exposure is most likely in internet-accessible deployments, forks, or copied installations of the referenced PHP/MySQL Online Food Ordering System v2 code. The source bundle does not provide CPEs or precise vendor/version metadata, so inventory must rely on code ownership and route inspection.
Exploitation context
The source bundle includes a public GitHub reference for the issue, but it does not show CISA KEV listing or confirmed active exploitation. Do not assume exploitation in the wild from this evidence alone. Public disclosure still increases scanning and opportunistic probing risk for exposed copies.
Researcher notes
Key uncertainty: the CVE description says SQL injection, while the listed CWE and CVSS vector align more closely with reflected input issues such as XSS. Validate against the actual source code before classification. The record also lacks CPEs and official remediation details.
Mitigation direction
- Check the project or vendor page for updated guidance before assuming a fixed release exists.
- Review view_order.php and replace unsafe SQL construction with parameterized database queries.
- Validate the id input as an expected order identifier before database use.
- Restrict administrative or order-view pages to authenticated, authorized users.
- Use least-privilege database credentials for the application account.
- Monitor web and database logs for abnormal order-view access patterns.
Validation and detection
- Inventory any deployment or fork of Online Food Ordering System v2.
- Confirm whether view_order.php exists and accepts an id parameter.
- Review code paths handling id for parameterized queries and authorization checks.
- Verify the application account cannot read or modify unnecessary database tables.
- Check logs around order-view routes for unusual access volume or errors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-24197 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.