This vulnerability exists in SourceCodester Simple Online Food Ordering System 1.0 within the /admin/ajax.php?action=delete_menu file. The ID argument is not properly sanitized, enabling remote attackers to inject SQL commands. This could allow unauthorized database queries or modifications. The vulnerability is remotely exploitable without authentication. No official patch or remediation guidance is currently available from the vendor or advisory sources. The CVSS 4.0 score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and validate or sanitize input parameters at the application level to mitigate injection risks.