This vulnerability in code-projects Online Food Order System 1.0 involves an SQL injection flaw in the /edit_food_items.php script. An attacker can remotely exploit the 'update' parameter to inject malicious SQL queries, potentially compromising the database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability. The vulnerability is publicly known but no official fix or patch has been published yet.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the 'update' parameter. This may lead to unauthorized data access or modification, but the impact is rated as medium with limited confidentiality, integrity, and availability impact according to the CVSS vector. There are no confirmed exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable script or applying web application firewall rules to detect and block SQL injection attempts targeting the 'update' parameter. Monitor vendor channels for updates and patches.