A flaw in the search.php file of SililaWijesinghe Food Ordering System allows an attacker to inject arbitrary SQL through the search_box argument. This improper input handling (CWE‑74) and resulting SQL injection (CWE‑89) enable remote theft, modification or disclosure of sensitive data stored in the underlying database.

The issue affects all releases of the Food Ordering System from SililaWijesinghe that include the code before commit ba314e897e3365600461e5ea59432e39ceaa0fa5. Since the product follows a rolling‑release model, the exact downstream versions are not enumerated in the advisories, but any build lacking the fixed commit remains vulnerable.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, so the current exploitation probability cannot be quantified, but the defect is publicly documented and can be exploited remotely from a web interface. It is not listed in the CISA KEV catalog, implying no known widespread attacks yet. Remote exploitation is straightforward by sending a crafted search_box value to search.php, which can lead to unauthorized database access under the current configuration.