The flaw in the admin_edit_menu_action.php script allows an attacker to inject arbitrary SQL through the product_name parameter. The injection is triggered by manipulating the argument, and the vulnerability can be exploited from a remote client. Based on the description, it is inferred that an attacker could execute arbitrary SQL statements against the application database, potentially allowing data disclosure, modification, or loss. The impact covers confidentiality, integrity, and potentially availability of the ordering system.

This vulnerability affects itsourcecode’s Online Frozen Foods Ordering System version 1.0, as well as the variant listed under adonesevangelista version 1.0. Any deployment of these releases that exposes the admin interface to external traffic is susceptible.

The CVSS score of 5.1 indicates medium severity, while the EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be executed remotely via crafted input to the product_name parameter, and a publicly available exploit exists, meaning unpatched installations could be targeted by attackers from outside the network.