A flaw has been discovered in CodeAstro Online Catering Ordering System 1.0 that allows a remote attacker to manipulate the ID parameter in the deleteorder.php script. The manipulation leads to SQL injection, enabling the attacker to read, modify, or delete data within the underlying database. The vulnerability is exploitable over the network and has already been disclosed publicly, indicating that it may be actively used by threat actors.

CodeAstro Online Catering Ordering System version 1.0. The weakness exists in the deleteorder.php component, which processes the ID argument without proper validation or parameterization.

The CVSS score of 5.3 classifies this as moderate severity. EPSS information is unavailable, and the vulnerability is not included in the CISA KEV catalog. Based on the description, the attack vector is likely remote via HTTP/S, requiring the ability to send crafted requests to the affected endpoint. While the direct impact is limited to database manipulation, the potential to alter critical ordering or financial information could compromise business operations.