The system’s order_online.php file accepts a product_name parameter without proper sanitization, allowing attackers to inject arbitrary SQL. This flaw permits a remote attacker to read, modify, or delete data in the underlying database, compromising confidentiality, integrity, and potentially availability of the ordering system.

The vulnerability affects the itsourcecode Online Frozen Foods Ordering System, version 1.0, and the same version as listed under the adonesevangelista branch in the vendors registry. Users running this edition have a direct entry point exposed via the order_online.php endpoint.

The CVSS score of 6.9 indicates a moderate‑to‑high severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw is exploitable remotely from the public Internet and can be triggered by manipulating the product_name argument, allowing attackers to inject arbitrary SQL. The vulnerability is not currently listed in CISA’s KEV catalog.