Online Food Ordering System CVE-2025-11604

Exploitation requires that the projectworlds Online Food Ordering System 1.0 PHP application is network-accessible with the /all-orders.php endpoint reachable by the attacker. No authentication is required (PR:N confirmed by the CVSS 4.0 vector). No non-default configuration is needed - the vulnerable parameter exists in the default application as shipped. The primary limiting factor is deployment prevalence: this is an academic/demo project rarely deployed in production, meaning the realistic attack surface is very small. There are no platform-specific prerequisites beyond a PHP-capable web server with the application installed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitability, yet the resulting score of 5.5 with VC:L/VI:L/VA:L reflects constrained per-request impact rather than full system compromise. The EPSS score of 0.03% at the 9th percentile indicates negligible observed exploitation probability, consistent with a niche demo application that rarely appears in production environments. A public proof-of-concept lowers the technical barrier meaningfully - even a mid-sized municipal IT team in inowroclaw that carelessly deployed this demo for internal testing should treat exposed instances as an immediate removal priority rather than a scheduled patching task. No CISA KEV listing exists, confirming no verified active exploitation campaign. The realistic risk profile is low-to-moderate: the vulnerability is trivially exploitable but the product's footprint is extremely limited, making widespread mass exploitation unlikely.

An unauthenticated attacker sends a crafted HTTP request to /all-orders.php?Status=1'%20OR%201=1-- (or equivalent injection payload), causing the backend SQL query to return unintended result sets or execute attacker-controlled SQL logic. The publicly available proof-of-concept on GitHub (https://github.com/Duo-zhen/CVE/issues/4) demonstrates this technique, enabling database enumeration, credential extraction, or order record manipulation in a single unauthenticated request.