SourceCodester Simple Online Food Ordering System 1.0 contains a flaw in the /fos/admin/ajax.php script that processes a confirm_order action. The ID parameter can be manipulated to inject arbitrary SQL statements, allowing an attacker to read, modify, or delete data accessed by the application and potentially expose customer information or alter the database schema. The vulnerability is a classic example of the SQL injection weaknesses identified by CWE-74 and CWE-89.

The flaw exists in SourceCodester Simple Online Food Ordering System, version 1.0, when the confirm_order action of the ajax.php endpoint is accessed. No additional version identification is provided, so any deployment of this module should be considered vulnerable.

With a CVSS score of 6.9 the vulnerability presents moderate severity, threatening confidentiality and integrity of the application’s data. EPSS information is unavailable, yet the exploit is publicly available and can be triggered remotely via crafted HTTP requests to the confirm_order endpoint, indicating a meaningful exploitation probability. The vulnerability is not referenced in the CISA KEV catalog.