The vulnerability in the admin/ajax.php script of SourceCodester Simple Online Food Ordering System 1.0 allows an attacker to manipulate the ID parameter of the delete_category action and inject arbitrary SQL statements. The flaw is a classic input validation flaw that leads to remote SQL injection. Because the injection can be triggered over the public web interface, a remote attacker can read, modify, or delete data in the underlying database, potentially compromising the confidentiality and integrity of customer orders and related information.

The affected product is SourceCodester Simple Online Food Ordering System version 1.0. The vulnerable functionality resides in the admin panel’s ajax.php script, specifically the delete_category action. No other vendors or versions are listed, so the issue appears to be limited to this product’s default installation. Administrators deploying this system should verify that the identified file and action exist in their installation.

The CVSS score of 6.9 indicates a moderate severity. Exploitation is possible remotely via crafted HTTP requests to the delete_category endpoint, and the exploit has been publicly disclosed, implying that attackers could leverage community‑shared payloads. The EPSS score is not available, but the lack of KEV listing does not diminish the risk; many public SQL‑injection vulnerabilities are actively exploited before official patching. Consequently, the likelihood of exploitation is non‑negligible, making remediation a priority for all users of this version.