The reported flaw allows an attacker to supply arbitrary SQL code through the ID parameter of the delete_menu endpoint in the admin AJAX interface, causing the application to execute malicious statements on the underlying database. This level of control can lead to unauthorized read, update, or deletion of data, compromising the confidentiality, integrity, and availability of the system’s information. The weakness is an injection flaw categorized as CWE‑74 and CWE‑89.

SourceCodester Simple Online Food Ordering System, version 1.0, accessed through the /admin/ajax.php action delete_menu endpoint.

The CVSS score of 6.9 indicates a medium impact risk, and despite the EPSS score being unavailable, the exploit is publicly disclosed and can be launched remotely by an unauthenticated attacker. The attack vector is remote, requiring only the ability to construct a malicious ID value, and hosts the potential for complete data disclosure or manipulation if not mitigated. The vulnerability is not listed in CISA KEV, but its public availability means that a risk assessment should be performed promptly.