This vulnerability is a SQL Injection (CWE-89) in the payment.php component of Restaurant Order System 1.0. It enables a local attacker with low privileges to execute unauthorized SQL queries, potentially leading to disclosure of sensitive data. The CVSS vector indicates low attack complexity and no user interaction required, with high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or vendor advisory has been provided.

Successful exploitation can lead to full compromise of sensitive information within the database, including potential unauthorized data disclosure, modification, and disruption of service. The attacker requires local access but can achieve high impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to payment.php. Avoid exposing the vulnerable component to untrusted users.