This vulnerability affects SourceCodester Simple Online Food Ordering System 1.0. It arises from improper handling of the ID argument in the /fos/admin/ajax.php?action=confirm_order file, enabling SQL injection attacks. The vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation. No vendor advisory or patch information is currently provided, and the remediation level is unknown.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, modification, or deletion. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected functionality to untrusted networks if possible.