A flaw in code-projects Online Food Order System version 1.0 allows attackers to manipulate the "update" parameter in /edit_food_items.php, enabling arbitrary SQL statements to be executed against the backend database. The weakness is a classic input‑validation failure that can lead to data disclosure, modification, or deletion, affecting all records managed by the system. This vulnerability is identified as CWE-74 (CWE-74) and CWE-89 (CWE-89).

The impacted product is Code‑Projects Online Food Order System version 1.0. The vulnerability resides in edit_food_items.php; the publicly accessible nature of this script is not explicitly stated in the vendor documentation, so it remains unclear whether the file is exposed to unauthenticated users or only to administrators.

The CVSS score of 6.9 indicates moderate to high severity. The description states that the attack can be launched remotely, implying network access, and that public exploit code has been released. The EPSS score of <1% suggests a very low estimated probability of exploitation, and the vulnerability is not listed in CISA KEV. Because the entry does not specify whether administrator authentication is bypassed, it is inferred that the attacker may need to access the web interface, but the exact authentication requirement is uncertain.