A vulnerability exists in the Simple Food Order System due to improper validation of the 'price' parameter in the /routers/add-item.php file, allowing malicious SQL statements to be executed. The impact is that an attacker can read, modify, or delete arbitrary database records, compromising confidentiality and integrity of the application data. The flaw is categorized as CWE-74 (Command Injection) and CWE-89 (SQL Injection). Key detail from vendor description: Such manipulation of the argument price leads to sql injection.

The affected product is code-projects’ Simple Food Order System. No explicit version information is provided in the CVE data; therefore it is unclear which releases are vulnerable. The vulnerability resides in the add-item.php endpoint of the router layer.

The CVSS v3.1 base score is 6.9, indicating moderate severity. EPSS information is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as stated in the CVE description: The attack can be launched remotely. Exploitation is publicly available, implying that attackers who can reach the vulnerable endpoint may easily perform the injection.