The Simple Food Order System version 1.0 has a flaw in the /food/routers/edit‑orders.php script that allows attackers to inject arbitrary SQL statements. This vulnerability can enable an adversary to retrieve, modify, or delete order data stored in the database, potentially leading to data exposure or compromise of the system’s integrity. The weakness is a classic input‑validation failure outlined by CWE‑89.

The affected product is Carmelo’s Simple Food Order System v1.0, as identified by the CPE string. No other versions or related products are listed.

With a CVSS score of 9.8, the vulnerability is considered critical. Even though the EPSS score is reported as less than 1 %, exploitation is still possible, especially if the endpoint is exposed publicly. The vulnerability is not recorded in the CISA KEV catalogue. Attackers likely target the /food/routers/edit‑orders.php endpoint via remote web requests; authentication or privilege prerequisites are not explicitly stated, so the exact attack vector remains uncertain but the potential for data compromise is high.