The vulnerability is a classic SQL Injection originating from the save_customer action in the Actions.php script. Because the application does not escape or parameterize the username input, an attacker can inject arbitrary SQL statements, enabling the attacker to read, modify, or delete user and order data, and potentially gain elevated access to the underlying database. The weakness is an input validation flaw that permits unauthorized data exposure.

The flaw exists in SourceCodester Online Food Ordering System version 1.0, specifically the Actions.php component that handles customer creation. No other vendors or product versions are listed.

The reported exploit relies on submitting crafted data via the public web interface, a likely exploitation vector for attackers with web-access. While no official CVSS score or EPSS data is provided, the potential to manipulate critical customer data suggests a high severity. The lack of a KEV entry indicates that there are no documented real-world exploits yet, but the straightforward injection path makes the vulnerability attractive for opportunistic attackers.