A SQL injection flaw exists in the save_category action of the Actions.php script within SourceCodester Online Food Ordering System version 1.0. The application does not properly sanitize the \"name\" input, allowing an authenticated user to inject and execute arbitrary SQL statements. This can lead to unauthorized data modification, disclosure, or possible database compromise, representing a high‑risk vulnerability classified as CWE-89.

The vulnerability affects SourceCodester Online Food Ordering System, specifically version 1.0, where category data is managed via the Actions.php file.

Exploitation requires an authenticated session with the application; therefore, attackers must first obtain valid credentials. Once authenticated, the attacker can craft a request to the save_category endpoint with malicious SQL payloads. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, but the lack of input validation and the potential for data integrity and confidentiality loss make the risk high.