A flaw in the SourceCodester Food Ordering System version 1.0 allows an attacker to inject arbitrary SQL via the custom parameter in the file purchase.php. The vulnerability resides in an unspecified function within the Parameter Handler component, and the injection can lead to unauthorized data access or modification. This weakness aligns with CWE-74 and CWE-89, representing improper handling of input and the creation of untrusted SQL statements.

The issue affects the SourceCodester Food Ordering System 1.0, specifically the purchase.php module that processes user supplied custom parameters. Users running this version on any environment without an applied patch are in direct danger.

The CVSS score of 6.9 indicates a medium severity impact; with no EPSS data the likelihood cannot be quantified, but the vulnerability has been publicly disclosed and could be exploited remotely by sending crafted requests. The attack vector is inferred to be remote, as the description states the attack can be initiated remotely. Because the vulnerability is not in the CISA KEV catalog, it may not yet have known active exploits, but the potential for data compromise remains.