This vulnerability affects code-projects Simple Food Order System 1.0 and involves an SQL injection in the /all-tickets.php file's Parameter Handler component. Specifically, the Status parameter can be manipulated remotely without authentication to inject SQL commands. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with exploit code available, but no official patch or fix has been provided by the vendor. The system is self-hosted, so remediation depends on the user or vendor providing a fix.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact on confidentiality, integrity, and availability is rated as low, reflecting limited potential damage. The availability of public exploit code increases the risk of exploitation, though no active attacks have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should consider implementing input validation and parameterized queries as temporary mitigations. Monitoring for unusual database activity and restricting access to the affected endpoint may reduce risk. Stay alert for vendor updates providing an official fix.