An SQL injection flaw was discovered in the delete.php file of the code‑projects Online Product Reservation System version 1.0. An attacker can inject arbitrary SQL via the ID field that the application trusts without sanitization, causing the backend database to execute unintended commands. This potentially allows the attacker to read, modify, or delete data in the reservation tables, which could compromise customer records, financial information, and operational integrity.

The vulnerability affects the code‑projects Online Product Reservation System, specifically version 1.0. All installations of this application that process POST requests to /app/checkout/delete.php are impacted. No other product versions are mentioned.

The CVSS v3.1 score is 5.3, indicating medium severity. EPSS is reported as less than 1 %, suggesting low but non‑zero exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, implying it has not been identified as a widely active exploit. The attack can be carried out remotely by sending a crafted HTTP POST request to the delete endpoint; the description does not mention authentication requirements, so the risk could be mitigated only if the application enforces user sessions before processing the ID.