This vulnerability affects SourceCodester/katojkalemba Online Food Ordering System version 1.0. An SQL injection flaw exists due to improper sanitization of the ID argument in the /web/category-foods.php file. This allows remote attackers to inject malicious SQL commands, potentially compromising the backend database. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 6.9, indicating a medium level of severity. Public exploit code is available, increasing the risk of exploitation. No vendor advisory or patch information is provided, so remediation status is unknown.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate database queries, potentially leading to unauthorized data access, data modification, or other database-related impacts. The vulnerability is remotely exploitable without user interaction or privileges, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability, consistent with a medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /web/category-foods.php. Additionally, review and harden input validation and parameter sanitization in the affected application code if possible.