This vulnerability affects code-projects Online Food Order System version 1.0. It is caused by improper sanitization of the 'update' parameter in the /edit_food_items.php script, leading to SQL injection. An attacker can remotely exploit this flaw to manipulate SQL queries, potentially impacting data confidentiality, integrity, and availability. The vulnerability is publicly disclosed with a CVSS 4.0 score of 6.9, indicating a medium level of severity. No vendor-provided patch or official remediation is currently documented.

Successful exploitation of this SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion, impacting the confidentiality, integrity, and availability of the system's data. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, suggesting some constraints on the attack's effectiveness.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce risk. Monitoring for unusual database activity may also help detect exploitation attempts.