This vulnerability affects SourceCodester Simple Online Food Ordering System version 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the ID argument in the /fos/view_prod.php script. The vulnerability allows injection of SQL commands, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code exists, but no vendor patch or official remediation is currently available.

Successful exploitation could allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized access or modification of the backend database. The impact is limited to the confidentiality, integrity, and availability of the affected system's data as indicated by the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or web application firewall rules to block malicious SQL injection payloads targeting the ID parameter in /fos/view_prod.php. Monitor for updates from the vendor regarding patches or official mitigations.