A flaw in the admin_edit_supplier.php page of the Online Frozen Foods Ordering System allows an attacker to inject arbitrary SQL through the Supplier_Name field. Because the input is concatenated directly into a database query, a malicious user can read, modify, or delete supplier records and potentially access other database objects. This read/write capability threatens the confidentiality, integrity, and availability of the ordering system’s data.

The vulnerability affects itsourcecode’s Online Frozen Foods Ordering System version 1.0. No other versions are listed as affected. The flaw exists in the administrative supplier editing interface.

The CVSS score of 5.3 denotes moderate severity, while an EPSS score of less than 1% indicates a very low probability of widespread exploitation in the general population. The vulnerability is not in the CISA KEV catalog. The attack can be started remotely with HTTP access, and a public exploit is available, meaning any user who can reach the admin page could potentially inject SQL without authentication. No advanced prerequisites are required beyond remote web access.