This vulnerability affects SourceCodester/katojkalemba Online Food Ordering System 1.0. An attacker can remotely exploit an SQL injection flaw by manipulating the ID argument in the /web/order.php script. This allows unauthorized SQL commands to be executed against the backend database. The vulnerability is publicly disclosed with a CVSS 4.0 score of 6.9 (medium severity). No vendor patch or fix details are available in the provided data.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication and requires low attack complexity. However, the impact is rated medium due to limited information on the extent of data exposure or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the ID parameter in /web/order.php.