The system fails to sanitize user input supplied to the "username" parameter in the save_user action within Actions.php. This flaw permits an attacker to inject malicious SQL commands, potentially allowing unauthorized reading, modifying, or deleting data in the database. The weakness is classified as CWE-89, a typical SQL injection vulnerability.

The vulnerability affects the SourceCodester Online Food Ordering System, version 1.0, as identified by the provided CPE string. No other versions or vendors are listed, so only this specific release is at risk.

With a CVSS base score of 8.8, the vulnerability is high severity. The EPSS indicates a probability of exploitation below 1%, and it is not listed in the CISA KEV catalog. The likely attack vector is a network‑based, authenticated attack: the user must be logged in to input the vulnerable username field. Exploitation could lead to data leakage, tampering, or privilege escalation within the application.