The vulnerability is a classic SQL injection in the save_user action of the Actions.php script for SourceCodester Online Food Ordering System version 1.0. The application fails to properly escape or validate the username parameter, enabling a malicious input to alter the underlying SQL query. This flaw can allow an authenticated user to execute arbitrary SQL commands, potentially exposing sensitive data or modifying or deleting records.

Only the SourceCodester Online Food Ordering System v1.0 is affected, specifically the Actions.php file handling the save_user action.

No CVSS or EPSS metrics are available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires prior authentication, which limits the attack surface to users with valid credentials. Once authenticated, an attacker can submit a crafted username to manipulate the SQL query, potentially gaining unauthorized database access. Because the vulnerability is not known to be actively exploited, the immediate risk is moderate, but the potential impact on confidentiality, integrity, or availability is significant if an attacker can inject SQL.