SQL injection occurs in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 when the store_id parameter in a POST request is not properly sanitized. An attacker can alter this parameter to inject arbitrary SQL, enabling the retrieval of sensitive backend database information. The vulnerability results in unauthorized data disclosure with a CVSS base score of 9.8, indicating a critical level of risk.

The exposed product is Order Up Online Ordering System version 1.0. No other affected versions were identified in the CNA data.

The CVSS score of 9.8 demonstrates a severe threat, while the EPSS score of less than 1% suggests that, as of the data provided, exploitation is unlikely to occur frequently. The vulnerability can be triggered by any unauthenticated actor who can send a crafted HTTP POST request to the vulnerable endpoint, likely from any network location that can reach the API service. Although the exploit does not require authentication or privilege escalation, successful exploitation would allow an attacker to view or potentially modify sensitive database contents, compromising confidentiality.