The Simple Food Order System v1.0 contains a flaw in the /food/view-ticket-admin.php endpoint that permits SQL injection. This weakness—classified as CWE-89—allows an attacker to manipulate database queries, read confidential order data, alter records, and potentially execute arbitrary commands if the underlying database privileges are permissive. The impact is loss of confidentiality, integrity, and potentially availability of the ordering system.

The vulnerability exists in the Simple Food Order System library version 1.0 developed by an unnamed vendor identified as Carmelo. No other versions or vendors are listed as affected.

The CVSS score of 9.8 marks this issue as critical, yet the Enterprise Platform Security Score (EPSS) is reported as less than 1%, indicating a very low probability of exploitation under current conditions. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is a remote web request to the mentioned endpoint, although authentication requirements are not specified. Even with low current exploitation likelihood, the high severity warrants timely mitigation.