A classic SQL injection flaw exists in the admin/manage_category.php page of the online food ordering system. The flaw allows an attacker to supply an unsanitized "id" value in a request, causing the application to embed arbitrary SQL statements into its database query. If exploited, the attacker could read, modify, or delete data stored in the system’s database, thereby compromising both data confidentiality and integrity. The weakness is categorized as CWE-89, Improper Neutralization of Special Elements used in an SQL Statement.

The vulnerability affects the oretnom23 Online Food Ordering System, version 1.0. No other releases or vendor patches are documented, and the vendor has not released an advisory.

The CVSS score of 8.3 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is a remote HTTP request to admin/manage_category.php, likely requiring administrative authentication. The impact scope appears to be limited to the database accessed by that page, with potential to compromise all stored data if an attacker gains access.