CVE-2026-8231 — CodeAstro Online Catering Ordering System SQL Injection

title: CVE-2026-8231 - CodeAstro SQL Injection in deleteorder.php
id: scw-2026-05-10-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-8231 by targeting the deleteorder.php script in CodeAstro Online Catering Ordering System. The rule looks for specific SQL injection patterns within the 'ID' or 'id' parameter in the URI query, indicative of attempts to manipulate the database.
author: SCW Feed Engine (AI-generated)
date: 2026-05-10
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8231/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri:
          - '/deleteorder.php'
      cs-uri-query|contains:
          - 'ID='
          - 'id='
      cs-uri-query|contains:
          - ' OR ' 
          - ' UNION '
          - ' SELECT '
          - ' FROM '
          - ' WHERE '
          - ' SLEEP('
          - ' BENCHMARK('
      cs-method:
          - 'GET'
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse