The Simple Food Order System 1.0 from code-projects contains an SQL injection vulnerability in the all-orders.php file's Parameter Handler component. Specifically, the 'Status' parameter can be manipulated by an unauthenticated remote attacker to inject SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on 2026-03-28, but no patch or official fix has been provided.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the 'Status' parameter. This may lead to unauthorized data access or modification. However, the impact is rated as medium, with limited confidentiality, integrity, and availability impacts according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or parameterized queries to mitigate SQL injection risks in the affected component. Monitor vendor communications for updates on patches or official mitigations.