A SQL injection flaw exists in the save_category action of SourceCodester Online Food Ordering System v1.0. Because the application does not properly escape or validate the user supplied 'name' parameter, an authenticated user can inject arbitrary SQL statements. The vulnerability falls under CWE‑89 and allows attackers to read, modify, or delete database records, potentially exposing sensitive order data or altering application state.

The affected product is SourceCodester Online Food Ordering System version 1.0, specifically the Actions.php file handling the save_category function. No other vendors or product versions are explicitly listed.

The CVSS v3.1 score of 8.8 rates it as High, reflecting the potential for widespread impact when exploited by an authenticated user. The EPSS score is less than 1 %, indicating a low probability of exploitation in the wild. It is not currently listed in CISA’s KEV catalog. An attacker must first authenticate to the system and then issue a crafted HTTP request to the save_category endpoint. Upon successful exploitation, the attacker can execute arbitrary SQL, compromising confidentiality, integrity, and potentially availability of the database.