Manipulation of the ID argument in the view_order.php file of SourceCodester Simple Online Food Ordering System 1.0 causes an SQL injection flaw that allows an attacker to craft arbitrary SQL statements. The impact is that the attacker can retrieve, modify, or delete sensitive data from the underlying database or even gain administrative access if higher‑privilege accounts exist. This vulnerability was classified as a moderate severity flaw with a CVSS score of 6.9.

The affected product is SourceCodester Simple Online Food Ordering System version 1.0. The exact function contaminated is view_order.php, and no additional versions are listed as impacted. No vendor-provided version range was supplied, so all installations running 1.0 are considered vulnerable unless otherwise noted by the vendor.

The CVSS score of 6.9 indicates a moderate risk, and the EPSS score is not available from the data set, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, but the public release of an exploit and the note that it can be performed from remote via HTTP query parameters suggest that it is a realistic threat. An attacker with network access to the web server can trigger the injection and potentially obtain unauthorized data access or manipulation.