SourceCodester Online Food Ordering System 2.0 contains a file inclusion vulnerability in the /index.php file's include function. By manipulating the 'page' parameter, an attacker can cause the application to include unintended files, potentially leading to information disclosure or code execution depending on the included content. The vulnerability is remotely exploitable without privileges or user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. No vendor-provided patch or official remediation is currently documented.

Successful exploitation of this vulnerability allows an attacker to include arbitrary files on the server, which may lead to information disclosure or remote code execution depending on the server environment and included files. The impact is rated medium severity with a CVSS score of 6.9. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or filtering on the 'page' parameter to prevent arbitrary file inclusion. Monitoring for suspicious activity related to this parameter is advisable. Avoid exposing vulnerable versions to untrusted networks where possible.