The vulnerability lies in the way the admin/manage_category.php script handles the "id" parameter, allowing an attacker to inject malicious SQL code. This flaw can enable the execution of arbitrary SQL statements, potentially granting the attacker read, modify, or delete rights on the underlying database. In a high‑privilege scenario the attacker could compromise entire user data sets or business records.

SourceCodester Online Food Ordering System version 1.0, specifically the admin category management component accessed via manage_category.php. No other product versions are presently listed as affected.

No EPSS score or KEV designation is available, and the severity rating is not provided, which suggests limited public exploitation data. Nonetheless, the flaw is reasonably exploitable given that it accepts a publicly accessible parameter. An attacker who can reach the admin interface—whether through compromised credentials or an exposed management endpoint—could manipulate database contents. The risk includes unauthorized access to sensitive data or service disruption through data corruption.