This vulnerability affects code-projects Online Food Order System version 1.0. It is caused by improper sanitization of the 'checkbox' argument in an unknown function within delete_food_items1.php, allowing remote attackers to perform SQL injection. The CVSS 4.0 score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. Although an exploit has been published, there are no reports of active exploitation in the wild. No official fix or patch has been disclosed by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts and the requirement for low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected functionality and monitor for suspicious activity related to the 'checkbox' parameter. Avoid exposing the vulnerable endpoint to untrusted networks if possible.