A flaw in the admin login page (admin.php) of the code‑projects Online Food Ordering System allows an attacker to insert arbitrary SQL through the Username field. The vulnerability stems from unvalidated user input being incorporated directly into database queries; this lack of validation is inferred from the injection capability. Successful exploitation could enable the attacker to read, modify, or delete data in the database, potentially exposing sensitive customer information or compromising system integrity.

The issue affects code‑projects Online Food Ordering System 1.0. The vulnerable component is the /admin.php file used for administrative authentication. No other products or versions are explicitly listed as affected; therefore, other versions or similar applications are presumed not to be impacted unless they share identical code.

The CVSS score of 6.9 classifies the vulnerability as medium severity. The EPSS score of less than 1 % indicates a low probability of exploitation at present, but reference links reveal publicly available exploit scripts, meaning that a remote attacker who can reach the /admin.php endpoint could craft an HTTP request containing a malicious Username parameter to execute the injection. The attack requires remote access to an exposed web page, making publicly facing deployments more vulnerable; the likely attack vector is inferred to be remote via HTTP to the /admin.php page. The vulnerability is not listed in the CISA KEV catalog, but the existence of exploit code elevates the practical risk.