This vulnerability allows an attacker to perform SQL injection via the ID argument in the /deleteorder.php file of CodeAstro Online Catering Ordering System 1.0. The flaw permits remote exploitation without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity with partial impact on confidentiality, integrity, and availability. No official fix or patch has been published, and the affected function within the file is unspecified.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint, applying web application firewall rules to detect and block SQL injection attempts, and monitoring for suspicious activity related to the /deleteorder.php endpoint. Avoid relying on untrusted input for database queries.