This vulnerability allows an attacker to inject arbitrary SQL code via the "id" parameter in the admin view_product.php script of SourceCodester Online Food Ordering System v1.0. The injection could be used to read, modify, or delete data in the underlying database, resulting in loss of confidentiality, integrity, and availability of sensitive information. The description indicates a typical SQL injection weakness (CWE‑89).

SourceCodester Online Food Ordering System version 1.0 is affected. No other products or versions are listed. The vulnerability resides in the admin module, specifically the view_product.php file.

The exact CVSS score is not provided, but SQL injection vulnerabilities are often considered high risk because they can be exploited from external input. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited publicly. The attack vector is inferred to be remote, via manipulation of the URL parameter "id".