This vulnerability allows an attacker to inject malicious SQL code via the ID parameter in the /deleteorder.php script of CodeAstro Online Catering Ordering System 1.0. The injection occurs due to insufficient input validation or sanitization, enabling remote attackers to potentially manipulate backend database queries. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been documented, and the vendor has not provided remediation details.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. However, the impact is rated medium with limited confidentiality, integrity, and availability effects. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once released.