Simple Food Ordering System CVE-2025-11613

Exploitation requires valid authentication credentials (PR:L in CVSS vector) - the attacker must have a legitimate user account and be authenticated to the Simple Food Ordering System. This is a significant limiting condition; unauthenticated attackers cannot trigger this vulnerability. The vulnerable code path is specifically the cname parameter processing in /addcategory.php, a function typically accessed only by users with administrative or category management privileges. No special application configuration or deployment mode is noted as a prerequisite; the vulnerability is inherent to the cname parameter handling in the default code. The attack does NOT require user interaction beyond the attacker's own actions (UI:N).

This vulnerability presents a paradoxical risk profile. CVSS 2.1 with low severity (VC:L/VI:L/VA:L) and limited scope indicates restricted blast radius - authenticated SQL injection typically affects only specific data accessible via that query context rather than system-wide compromise. The EPSS score of 0.03% (8th percentile) strongly suggests this will not be exploited at scale in the wild, despite public POC availability. The authentication requirement (PR:L in CVSS vector) is a significant limiting factor: exploitation requires valid login credentials, which dramatically reduces attack surface compared to unauthenticated SQL injection. The discrepancy between publicly available exploit code and ultra-low EPSS suggests this is a low-interest, low-impact bug in a niche product with minimal deployment footprint. Real-world risk is substantially lower than raw CVSS score implies. Defenders should prioritize this below common authentication bypasses or unauthenticated RCE vulnerabilities in similarly-deployed systems.

An authenticated user (e.g., a restaurant staff member with legitimate login credentials) navigates to the add category form and injects SQL syntax into the category name field, such as cname=' OR '1'='1, which alters the SQL query logic to extract menu data from other restaurant accounts or unintended database tables. Publicly available POC code demonstrates this exploitation path directly, reducing the barrier to attack by automated tools or script kiddies.