A critical SQL injection vulnerability exists in projectworlds Online Food Ordering System 1.0 that enables unauthenticated remote attackers to compromise database integrity.

The application is susceptible to SQL injection via the ID parameter in the view-ticket.php file, which allows unauthenticated attackers to execute arbitrary SQL queries against the backend database.

Successful exploitation of this vulnerability allows unauthorized access to sensitive database information, potentially leading to data exfiltration or system compromise. With a CVSS score of 7.3, this flaw is categorized as High severity, posing a significant risk to the confidentiality and integrity of the application environment.

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable view-ticket.php endpoint or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Review database query logs for suspicious patterns, such as unexpected SQL syntax or unauthorized access attempts directed at the view-ticket.php script.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate threat to any organization running the affected version of the Online Food Ordering System. Organizations must prioritize the implementation of compensating controls and maintain strict network perimeter security until a vendor-authorized patch is available for deployment.