The Simple Food Order System in version 1.0 contains a SQL injection flaw in an unknown function within register-router.php that accepts a manipulated name parameter. This weakness, identified as a type of input validation failure, allows an attacker to inject arbitrary SQL commands. Successful exploitation could compromise the confidentiality and integrity of the underlying database, leading to data exposure, modification, or deletion.

The vulnerability affects the Simple Food Order System developed by code-projects, specifically the component that handles request parameter registration. Known affected version is 1.0, as referenced by the vendor's CPE string. System administrators should verify that this exact version is deployed before taking action.

The CVSS score of 6.9 classifies the issue as a medium severity problem, and the EPSS score indicates a very low probability of exploitation. However, because the flaw is exploitable remotely and a public exploit exists, the risk remains non‑negligible. The vulnerability is not listed in the CISA KEV catalog. Attackers who can reach the application over the network could potentially manipulate the name argument to execute arbitrary SQL queries.