The Simple Food Order System 1.0 contains a SQL injection flaw in the all-orders.php component triggered by manipulating the Status parameter. An attacker can inject arbitrary SQL statements, potentially exposing sensitive data or altering records in the database. The described vulnerability permits direct exploitation of the database layer without requiring authentication.

Affected products include code-projects Simple Food Order System version 1.0, accessible through the all-orders.php script. The issue emerges from the Parameter Handler component and can affect any deployment running this version of the application.

The CVSS score of 6.9 indicates moderate severity, while an EPSS score below one percent suggests a low expected exploitation rate. The vulnerability is not currently listed in CISA’s KEV catalog, though it is publicly disclosed. Based on the description, the attack vector is remote via a web interface, so any exposed instance of the application could be targeted. While exploitation probability is low, the potential impact on data confidentiality and integrity warrants timely remediation.