The Simple Food Order System 1.0 from code-projects contains a SQL injection vulnerability in the register-router.php file, specifically in the Parameter Handler component. An attacker can remotely manipulate the 'Name' parameter to inject SQL commands, potentially compromising the backend database. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, low complexity, and no privileges or user interaction required. The exploit code is publicly available, increasing the risk of exploitation. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the attack surface. However, no confirmed active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing input validation and parameterized queries as temporary mitigations to reduce the risk of SQL injection. Monitoring for unusual database activity may also help detect exploitation attempts.