This vulnerability is a SQL injection flaw in the Simple Food Order System, allowing an attacker to inject arbitrary SQL through the Status parameter within /all-tickets.php's Parameter Handler. Such injection can lead to unauthorized data exposure or manipulation of the underlying database. The flaw exists in version 1.0 and was disclosed as a publicly available exploit. Attackers can trigger the injection remotely by manipulating the Status parameter in HTTP requests sent to the vulnerable endpoint.

The affected software is the Simple Food Order System supplied by code-projects, currently at version 1.0. The vulnerability is situated in the Parameter Handler module of the all-tickets.php script. Systems running this application without an updated patch, especially those exposed directly to the internet, are susceptible.

The CVSS score of 6.9 indicates a moderate severity; the EPSS score below 1% suggests low but non‑zero exploitation probability. The vulnerability is not in CISA's KEV catalog, but the public release indicates it is exploitable. Because the attack can be performed remotely, a successful exploitation could grant attackers the ability to read, modify, or delete data stored in the database, depending on database privileges. No zero‑day or privileged escalation is required, and the exploit does not rely on complex prerequisites.