Food Ordering System CVE-2025-12314

Exploitation requires authentication as a high-privilege administrator user (PR:H from CVSS vector). The attacker must have valid login credentials or an active admin session to access /admin/deleteitem.php. The SQL injection occurs only when the delete item function is invoked with a crafted itemID parameter. No special server configuration or non-default settings are explicitly mentioned; the vulnerability appears present in default installations. The limiting factor is administrative access control - this is not a pre-authentication vulnerability and cannot be exploited by anonymous users or users with standard customer roles.

Risk is LOW in real-world deployments despite public exploit availability. The CVSS 4.0 vector reveals critical limiting factors: PR:H (requires high-privilege administrator), AV:N (network-accessible but gated by authentication), AC:L (attack is trivial once authenticated), and VC:L/VI:L/VA:L (impact is limited to confidentiality, integrity, and availability of only the item being deleted, not the full database or system). EPSS 0.03% (7th percentile) confirms minimal exploitation probability in the wild, suggesting the exploit is available but not broadly weaponized. The combination of mandatory admin authentication and low attack complexity creates a scenario where the vulnerability is most relevant to insider threats or compromised administrator accounts, not opportunistic remote attacks. The public POC lowers the technical bar for exploitation once an attacker gains admin access, but this is a control-plane issue (admin compromise) rather than a zero-trust breach vector.

An attacker obtains or compromises administrator credentials through phishing or password reuse. The attacker logs into the admin panel and navigates to the delete item functionality. They craft a malicious itemID value (e.g., itemID=1' OR '1'='1) in the HTTP request to /admin/deleteitem.php, injecting SQL that either deletes multiple items, extracts data from other tables, or modifies database structure. The public POC from GitHub (kaka00666/food-ordering-cve) provides ready-made payloads, eliminating the need for custom exploitation code.