CVE-2026-24494 — SQL injection vulnerability in Order Up Online Ordering System

CVE-2026-24494

SQL injection vulnerability in Order Up Online Ordering System PUBLISHED

Description (CNA)

SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a crafted store_id parameter in a POST request.

Affected (CNA)

Vendor / product	Versions
Order Up / Online Ordering System	affected 1.0

CWE

CWE-89

References

https://www.spartanssec.com/post/multiple-unauthenticated-sql-injection-vulnerabilities

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.