This vulnerability is a classic SQL injection flaw located in the cancel‑order handler of Simple Food Order System version 1.0. An attacker could inject malicious SQL statements that may read, modify, or delete database records, leading to full compromise of confidential order data, data integrity violations, and potential escalation of privileges if the database user has elevated rights. The weakness is identified as CWE‑89, confirming the absence of proper input validation and parameterization.

The affected product is Simple Food Order System, version 1.0, distributed by code‑projects. The vulnerable component is the cancel‑order script located at /food/routers/cancel-order.php. No other versions or vendors are listed as affected.

The CVSS score is 9.8, indicating critical severity, although the EPSS score is reported as <1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely able to exploit the flaw by sending crafted requests to the cancel‑order endpoint, which may be reachable to any authenticated or unauthenticated user with network access to the application.