The flaw is a SQL injection in the admin ajax endpoint that processes the ID parameter. Because the application does not properly sanitize or escape the input, a crafted value can break out of the intended SQL context and inject arbitrary commands. Attackers can retrieve database contents, modify records, or drop tables, compromising the confidentiality and integrity of application data.

The vulnerability is present in SourceCodester Simple Online Food Ordering System 1.0, the web‑based ordering platform available at sourcecodester.com. Any deployment of this version that has the /admin/ajax.php endpoint exposed to the Internet is affected.

The CVSS score of 6.9 indicates a moderate severity and the EPSS score is not available, but the exploit has been publicly disclosed and can be executed remotely over HTTP without any special privileges. The vulnerability is not listed in the CISA KEV catalog, yet a determined adversary can use it to exfiltrate data or alter inventory by sending malicious requests to the admin endpoint. The absence of authentication requirements in the public description suggests that the endpoint may be reachable for authenticated users only, but the remote nature compounds the risk.