Food Ordering System CVE-2025-12315

Exploitation requires valid administrative user credentials to access the /admin/menu.php endpoint. The SQL injection is triggered specifically when manipulating the itemPrice parameter during menu item creation or modification. No other special configuration, feature flag, or non-default deployment mode is mentioned in available sources, suggesting the vulnerability exists in the default state once authenticated as an admin. The attack cannot be executed by unauthenticated remote users or lower-privileged logged-in accounts (e.g., customer or vendor roles), if such role separation exists.

This vulnerability presents exceptionally low real-world risk despite being a valid SQL injection. Multiple signals converge: CVSS 4.0 score of 2.0 (severity CRITICAL in scale but minimal actual impact due to PR:H privilege requirement), EPSS 0.03% (7th percentile-lowest exploitation probability), and high-privilege requirement (PR:H) eliminate opportunistic threats. The attack vector is network-based and requires no user interaction, but the mandatory administrative authentication creates a substantial barrier. Public exploit availability increases the attack surface only for organizations running vulnerable versions with compromised admin accounts. This is not a zero-day, not actively exploited by threat actors (no KEV status provided), and represents a low-priority patch for most deployments. Organizations with strict admin credential hygiene face minimal risk.

An attacker with valid administrative credentials (obtained through credential theft or insider threat) logs into the administrative panel, navigates to the menu management interface (/admin/menu.php), and injects malicious SQL syntax into the itemPrice field (e.g., itemPrice=1' OR '1'='1). The unvalidated input is passed directly to a SQL query, allowing the attacker to extract sensitive data from the database or modify menu pricing, orders, or customer records.