Is there a public PoC exploit available for CVE-2025-11603?

Yes, a public proof-of-concept exploit is available for CVE-2025-11603. Prioritise patching immediately. EPSS: 0.0%.

Simple Food Ordering System CVE-2025-11603

Q: What is the CVSS score of CVE-2025-11603?

CVE-2025-11603 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-11 cna@vuldb.com

PHP SQLi Simple Food Ordering System Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:16 vuln.today

DescriptionCVE.org

A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulation of the argument Category results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.

Technical ContextAI

The vulnerability exists in the /editproduct.php endpoint of a PHP-based food ordering application. The Category parameter is passed to a SQL query without proper input validation or parameterized query mechanisms, allowing SQL injection (CWE-74: Improper Neutralization of Special Elements used in an Output). The affected product is identified via CPE as fabian/simple_food_ordering_system version 1.0. This is a classic case of unsafe string concatenation in SQL query construction, common in legacy PHP applications that predate widespread adoption of prepared statements.

RemediationAI

Upgrade to a patched version if available from the vendor at https://code-projects.org/, though no specific patch version is documented in available advisories. If upgrading is not immediately possible, implement parameterized queries (prepared statements) in the /editproduct.php file, specifically for all SQL operations involving the Category parameter. Additionally, enforce input validation on the Category parameter using allowlist validation (e.g., only permit alphanumeric characters and hyphens if the application logic permits). Apply principle of least privilege to the database user account used by the PHP application to limit the scope of SQL injection damage-restrict the account to SELECT permissions only if product functionality allows. Restrict network access to /editproduct.php to trusted administrative IP ranges via web application firewall or reverse proxy rules, which will reduce the attack surface without requiring code changes.