A remote attacker can manipulate the pid parameter in the add_to_cart action of the food ordering system’s ajax.php endpoint, causing injected SQL to be executed against the backend database. This gives the attacker the ability to read, modify, or delete customer and order data, undermining confidentiality and integrity of the system’s data. The vulnerability does not directly trigger remote code execution but can lead to significant data compromise.

The vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. No official fix version is listed, and it is unclear if later releases contain the issue; thus all installations of the affected version should be considered vulnerable.

The CVSS score of 6.9 reflects a moderate severity with a remote attack vector and user interaction. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale active exploitation at the time of analysis. However, the public disclosure and absence of mitigations suggest that an attacker could launch the exploit from a remote location by sending a crafted request to /admin/ajax.php?action=add_to_cart and manipulating the pid field.