The flaw is a classic SQL injection vulnerability arising from unsanitized handling of the product_name argument on the /admin/admin_edit_menu.php page. By injecting malicious SQL, an attacker can extract sensitive data, alter or delete records, and potentially compromise the entire ordering system. This weakens the confidentiality and integrity of the underlying database. The weakness corresponds to CWE‑74 (Improper Handling of Special Characters) and CWE‑89 (SQL Injection).

The vulnerability affects the Online Frozen Foods Ordering System developed by itsourcecode, version 1.0. The product also appears under the vendor adonesevangelista with a similar version. No other versions are listed as impacted, so the scope is limited to version 1.0 of the application.

The CVSS score of 5.1 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The vendor has not added this issue to the CISA KEV catalog, and no exploit mitigations are documented by the CNA. The reported attack can be carried out remotely by manipulating the product_name parameter, indicating that the vulnerability is exploitable over the network without additional privileges.