The vulnerability occurs when the "Name" argument in /fos/admin/ajax.php?action=save_settings is passed directly into an SQL query without proper neutralization of special characters. This flaw allows an attacker to inject arbitrary SQL commands, potentially modifying or extracting sensitive data from the database and compromising the integrity and confidentiality of the system. The flaw is a classic example of CWE‑74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE‑89 (SQL Injection). The vulnerability can be exploited remotely by sending a crafted HTTP request to the affected endpoint.

SourceCodester Simple Online Food Ordering System version 1.0 is the only identified affected release. No public patch or version update information is available in the vendor data, so the problem remains present in the current distribution.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not catalogued by CISA in the KEV list. Attackers can reach the vulnerable endpoint from any location with network access to the web application, but the description does not specify whether authentication is required to trigger the injection. Given the lack of publicly disclosed exploits, the risk is considered moderate, yet it should be treated as a high priority because a successful injection could lead to server compromise or data exfiltration.