A flaw in the Simple Food Order System’s add‐item.php script allows an attacker to tamper with the price parameter, producing an SQL injection that can read or modify the database. The injection can be triggered entirely remotely via an HTTP request, and the vulnerability is publicly available, making exploitation straightforward for hostile actors.

The vulnerability affects the code‑projects Simple Food Order System version 1.0. No other versions are listed in the advisory, so the impact is confined to the bundled add‑item.php code of that specific release.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests that large‑scale exploitation is unlikely at present. The vulnerability is not yet in the CISA KEV catalog. Attackers could exploit the flaw from the internet by sending crafted requests to the remote add‑item.php endpoint without requiring any special credentials, and publicly available exploit code raises the risk for opportunistic attacks.