An attacker can inject SQL code through the "id" query parameter in the admin/manage_product.php page of the SourceCodester Online Food Ordering System. This flaw allows the attacker to read, modify or delete product records in the database, potentially exposing sensitive information or disrupting inventory data. The weakness corresponds to the classic "SQL Injection" category of input validation failures (CWE‑89).

Only the SourceCodester Online Food Ordering System version 1.0 is affected, specifically its admin interface where the manage_product.php script resides. No other vendors or products are listed in the CNA data.

No CVSS or EPSS score is provided, and the vulnerability is not listed in CISA’s KEV catalog, so the exact likelihood of exploitation cannot be quantified. The most likely attack vector is a web request to the vulnerable endpoint with a crafted "id" value, which an attacker could send from any network that can reach the application. If exploited, the attacker would gain the same database privileges as the application, posing a high risk to confidentiality, integrity, and availability of product data.