PHP CVE-2025-11604

We need to produce a JSON object with the specified fields. All fields must be plain text strings, not arrays or objects. We synthesize from the given data: CVE-2025-11604.

Given input:

CVE ID: CVE-2025-11604 Description: A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. CVSS Score: 5.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-74 EPSS Score: 0.03% (percentile 9%) POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Online Food Ordering System References: several URLs.

KEV status not mentioned. So we assume not in KEV. POC publicly available. So exploitation status: "publicly available exploit code exists".

Now, we need to craft the JSON.

First field: product_name: "Online Ordering Food System" but must be 1-3 words. It's "Online Food Ordering System" from tags? The CPE product is "online_food_ordering_system". So product name: "Online Food Ordering System". Exactly.

summary: Not copy description. Original synthesis. Must start with impact verb and product. Suggested: "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to manipulate the Status parameter in /all-orders.php, leading to unauthorized data access or modification." Mention no active exploitation detected, POC exists, low EPSS.

"SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to inject malicious SQL via the Status parameter in /all-orders.php, potentially reading or altering database contents. The vulnerability has a publicly available exploit, but no active exploitation has been confirmed by CISA, and EPSS estimates a low 0.03% probability of exploitation."

technical_context: Underlying technology: PHP application, likely using MySQL. The vulnerability is SQL injection (CWE-89, but given CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). That's a generic injection, but SQLi is specifically CWE-89. However, the CWE provided is CWE-74. We'll mention it. Root cause: improper sanitization of user input in the Status parameter leading to SQL injection. Affected product from CPE: projectworlds online_food_ordering_system version 1.0. The issue is in /all-orders.php.

"Projectworlds Online Food Ordering System 1.0 is a PHP-based web application. The vulnerability exists in the /all-orders.php script, where the 'Status' argument is directly incorporated into an SQL query without proper sanitation, falling under CWE-74. This allows injection of arbitrary SQL commands via the affected parameter."

risk_assessment: Compare CVSS vector (provided as CVSS:4.0, but we need to translate to 3.1 for analysis? We can interpret: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L ... This is low impact on confidentiality, integrity, availability. So a successful attack yields limited impact. EPSS 0.03% very low. No KEV. POC exists. SSVC: exploitation is "poc" (public proof of concept), not actively exploited; automatable? Probably automatable because it's a simple URL parameter injection, but we need to check CVSS AT:N so automatable. Technical impact: low (limited C/I/A). So it's a low risk, not a priority. CVSS gives base score 5.5 (medium) but real-world risk is minimal. Mention conflicts: none.

"CVSS:4.0 vector indicates network attack with low impact on confidentiality, integrity, and availability, resulting in a medium base score (5.5). However, EPSS predicts only a 0.03% chance of exploitation, placing it in the 9th percentile — well below the threshold for active concern. No CISA KEV listing exists. While a public proof-of-concept exploit lowers the barrier to exploitation, the limited technical impact and low prevalence of this niche application keep real-world risk low. The SSVC decision would lean towards 'Track' rather than 'Act', as no active exploitation has been observed and impact is limited."

affected_products: "Projectworlds Online Food Ordering System version 1.0 is affected (CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0). No vendor advisory or fix information is available from the references provided; the vulnerability is reported via VulDB (id 327926)."

remediation: "No vendor patch is available at this time. As a workaround, implement input validation and parameterized queries for the Status parameter in /all-orders.php to neutralize SQL injection. Additionally, restrict access to the administrative or order management interface to trusted users, and consider web application firewall (WAF) rules to block SQL injection attempts. These mitigations may require code-level changes or external filters, with potential disruption if incorrectly configured."

exploit_scenario: "An attacker sends a crafted HTTP request to the /all-orders.php endpoint with a maliciously modified Status parameter, injecting SQL commands. This could extract sensitive data from the application's database or manipulate order statuses. Since a public exploit is available, an unauthenticated remote attacker with network access could easily reproduce the attack."

exploitation_conditions: The CVE description says: "This manipulation of the argument Status causes sql injection." No specific authentication or configuration mentioned. CVSS vector is AV:N/PR:N/UI:N, so remote unauthenticated. But we must note that it's a specific file /all-orders.php, likely part of an admin or backend interface. Maybe it requires some access? However, per CVSS PR:N so unauthenticated. We'll state: "The vulnerable script /all-orders.php is accessible without authentication, as indicated by the CVSS vector (PR:N). No special configuration is required for exploitation; the SQL injection is triggered by direct manipulation of the Status parameter in an HTTP request. There are no limiting conditions beyond the availability of the target application online." But if the file requires some prior session? Not indicated. So I'll say: "The vulnerability is exploitable remotely without authentication, as indicated by CVSS vector parameters. No specific user interaction or non-default configuration is necessary; the Status parameter in /all-orders.php is directly injectable."

attack_chain: "Send HTTP request with SQLi payload to /all-orders.php?Status=... → Database interprets injected SQL → Extract or modify order data". That's 3 steps. More detailed: "Access /all-orders.php endpoint → Inject malicious SQL into Status parameter → Database executes injected query → Attacker reads or alters data". Use "Access → Inject → Execute → Impact" four steps. I'll go with: "Send crafted request to /all-orders.php → Inject SQL payload via Status parameter → Backend database executes injected query → Sensitive data exfiltration or order manipulation". That's three steps with arrows. The field asks for 3-7 short steps separated by " → ". So I'll do: "Send HTTP request with malicious Status parameter → SQL injection into database query → Unauthorized data access or modification."

confidence_notes: "Exploit code publicly available on GitHub (Duo-zhen/CVE/issues/4), confirming reproducibility. No vendor advisory or patch information; affected version confirmed by CPE and VulDB entry. No CISA KEV listing, nor independent verification of active exploitation." Also mention that authentication requirements not explicitly confirmed from description but CVSS says PR:N.

prevalence: The product is a niche PHP application from Projectworlds, likely used as a learning or demonstration project, not widely deployed in enterprise. So prevalence is low. "low". Justification: "niche PHP demo system, limited real-world deployments". So "low".

prevalence_basis: "projectworlds' demo/tutorial-level application, not enterprise-scale"

assessed_cvss_vector: My own CVSS 3.1 vector. Given AV:N, AC:L, PR:N, UI:N, S:U (no scope change), Confidentiality Low (limited read), Integrity Low (modify maybe), Availability Low (maybe no DoS but limited). So: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's base score 6.3? Wait actually C:L/I:L/A:L yields score 7.1? Let's compute: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: (N, L, N, N, U) using formula: Impact subscore (ISS) = 1 - (1-C)*(1-I)*(1-A) = 1 - 0.9*0.9*0.9 = 1 - 0.729 = 0.271. Impact = 6.42 * ISS = 6.42 * 0.271 = 1.74. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85? Wait formula: Exploitability = 8.22 * AttackVector * AttackComplexity * PrivilegesRequired * UserInteraction. For AV:N=0.85, AC:L=0.77, PR:N=0.85, UI:N=0.85 => Exploitability = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * 0.4727 ≈ 3.886. Base Score = if Impact subscore <=0, 0; else roundup(min(Impact + Exploitability, 10))? Actually if Scope Unchanged, Base Score = roundup(min(Impact + Exploitability, 10)). 1.74 + 3.886 = 5.626, round up 5.7? Wait rounding rules: round up to one decimal: 5.626 -> 5.7. That's medium. But the provided CVSS 4.0 score is 5.5. So 5.7 is close. However, a more accurate assessment: The given CVSS:4.0 has VC:L/VI:L/VA:L, so impacted components vulnerable system confidentiality, integrity, availability all low. That suggests the SQL injection could read some data, modify some data, and cause limited availability impact (maybe denial of service). So C:L/I:L/A:L is appropriate. So I'll use that vector. I'll justify: "Network-accessible, low complexity, no privileges or user interaction; limited impact on all three CIA dimensions."

assessed_cvss_rationale: "Network-accessible, no auth or user interaction required; low impact on confidentiality, integrity, and availability."

assessed_cvss40_vector: The provided vector is already CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N . I can use that exact vector as my assessment, as it is consistent. But the instruction says "Your OWN independent CVSS 4.0 base vector" – I can reuse the same one if I agree. I'll keep it because it accurately reflects the vulnerability: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So I'll output that.

assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale: "Matches the provided vector, reflecting remote unauthenticated access with limited impact on the vulnerable system."

Now, put together all fields. All must be strings, no arrays.

Let's craft each field accurately.

product_name: "Online Food Ordering System"

summary: