The vulnerability is a classic SQL Injection (CWE‑89) that allows an attacker to inject arbitrary SQL through the "id" parameter in the admin/manage_product.php page. By exploiting this flaw, a malicious actor could read sensitive data, modify or delete database records, and potentially execute destructive commands that compromise data integrity and availability. The impact is primarily the unauthorized disclosure of confidential information and the risk of unauthorized manipulation of the application’s data store.

SourceCodester Online Food Ordering System version 1.0 is affected. The issue resides in the admin/manage_product.php module and can be accessed by any user who can supply a value to the "id" parameter in the HTTP request.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% reflects a low probability of exploitation in the wild, though the flaw is known and could be leveraged if the attacker gains network access. The vulnerability is not yet listed in the CISA KEV catalog, so there is no evidence of a widespread, targeted exploitation campaign. The likely attack vector is over the network via HTTP(s), targeting the vulnerable parameter without needing prior authentication.