The defect triggers a SQL injection vulnerability when the Username parameter is sent to /fos/admin/ajax.php?action=save_user. The flaw allows attacker‑supplied input to be injected into a database query, potentially enabling query modification, data exfiltration, or unauthorized data manipulation. The vulnerability resides in untrusted code paths that are not well‑protected. The impact is loss of data confidentiality, integrity, and possible availability if the database is damaged or locked.

SourceCodester Simple Online Food Ordering System v1.0, specifically the administrator Ajax handler for user creation. The vulnerability is located in the file /fos/admin/ajax.php and affects any deployment of this application using that code path.

The CVSS score of 6.9 indicates medium severity. The EPSS score is not available, but the public availability of an exploit suggests that the likelihood of exploitation is significant. The issue is not listed in the CISA KEV catalog, so it is not a known, widely‑used exploit. Attackers can likely begin exploitation remotely, provided they can construct a request to the vulnerable endpoint. No special privileges are required beyond network access to the application.