The vulnerability in SourceCodester Simple Online Food Ordering System 1.0 involves SQL injection via the pid argument in the /fos/admin/ajax.php?action=add_to_cart file. This improper input validation allows attackers to inject malicious SQL commands remotely, potentially compromising confidentiality, integrity, and availability of the system. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with moderate impact on confidentiality, integrity, and availability.

Successful exploitation could lead to unauthorized access or modification of the database, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication, increasing the risk of attack. However, no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and validate or sanitize input parameters to mitigate SQL injection risks.