What is the CVSS score of CVE-2025-5980?

CVE-2025-5980 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2025-5980?

Yes, a public proof-of-concept exploit is available for CVE-2025-5980. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5980?

Within 24 hours: Isolate affected Restaurant Order System instances from production networks or disable the /order.php endpoint if not critical to operations; implement WAF rules to block SQL injection payloads in the tabidNoti parameter; review access logs for exploitation attempts. Within 7 days: Conduct forensic analysis to determine if the system has been compromised; contact the vendor for patch status and timeline; evaluate alternative order management solutions. Within 30 days: Migrate to a patched version or replace the system entirely; implement network segmentation to limit database access; deploy enhanced monitoring and intrusion detection for SQL injection patterns.

Restaurant Order System CVE-2025-5980

EUVD-2025-17832 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-10 cna@vuldb.com

PHP SQLi Restaurant Order System Carmelogarcia

5.5

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-74 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Input neutralization, injection prevention
Impact	The CVSS 3.1 score of 7.3 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicates a network-accessible vulnerability requiring no authentication or user interaction, with low attack complexity. All three CIA triad components are impacted (Confidentiality, Integrity, Availability). The public disclosure of this vulnerability significantly increases real-world risk. While EPSS data is not provided, the combination of: (1) network accessibility without authentication, (2) publicly available exploit code, (3) SQL injection's high automatable nature, and (4) the small user base typical of 'code-projects' repositories suggests MODERATE-to-HIGH exploitation probability. This is a legitimate priority issue—SQL injection in production systems with public exploits warrants immediate patching regardless of version popularity.
Exploit ScenarioDerived	An attacker identifies the vulnerable /order.php endpoint and crafts a malicious request manipulating the 'tabidNoti' parameter with SQL injection payload (e.g., tabidNoti=1' OR '1'='1' UNION SELECT username,password FROM users--). Since the attack vector is Network (AV:N), no authentication required (PR:N), and attack complexity is low (AC:L), the attacker can execute this remotely without credentials. The injected SQL executes within the application's database context, allowing the attacker to: extract sensitive data (customer information, payment details), modify database records (orders, pricing), or cause denial of service by resource exhaustion. With public exploit code available, even unskilled attackers can execute this attack against vulnerable Restaurant Order System 1.0 instances exposed on the internet.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Critical SQL injection vulnerability in code-projects Restaurant Order System 1.0 affecting the /order.php file, specifically the 'tabidNoti' parameter. Remote unauthenticated attackers can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.

RemediationAI

Immediate actions: (1) Apply input validation to the 'tabidNoti' parameter using parameterized queries/prepared statements in /order.php; (2) Implement whitelist validation to ensure 'tabidNoti' contains only expected numeric table identifiers; (3) Escape all database input using PHP's mysqli_real_escape_string() or PDO prepared statements; (4) Apply principle of least privilege to database user accounts. If available, upgrade to a patched version beyond 1.0. Temporary mitigation: implement Web Application Firewall (WAF) rules blocking SQL injection patterns in the /order.php endpoint and restrict access to this endpoint by IP if possible. Monitor database logs for SQL injection attempts.

Affected VersionsENISA

Restaurant Order System 1.0

Affected Packages

euvd restaurant_order_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which represents improper input validation in SQL contexts. The Restaurant Order System's /order.php file fails to properly sanitize or parameterize the 'tabidNoti' parameter before incorporating it into SQL queries. This classic SQL injection flaw allows attackers to break out of intended SQL syntax and execute arbitrary database commands. The vulnerability affects code-projects Restaurant Order System version 1.0, a web-based restaurant management application written in PHP that processes customer orders and manages table information through database queries.

Know when Restaurant Order System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

PoC Detected

Jun 16, 2025 - 14:52 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 21:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Restaurant Order System 1.0. This vulnerability affects unknown code of the file /order.php. The manipulation of the argument tabidNoti leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A remote SQL injection vulnerability in the Restaurant Order System 1.0 allows unauthenticated attackers to compromise database integrity and potentially exfiltrate sensitive customer and business data. With public exploits available and no vendor patch released, this poses an immediate risk to any organization running this system, particularly affecting customer order data, payment information, and operational records.

Business Impact: High

Compensating Controls

Implement Web Application Firewall (WAF) rules to block SQL injection attempts in the tabidNoti parameter using pattern matching for SQL keywords and special characters; restrict /order.php access via network firewall to authorized IP ranges only; disable the order functionality if operationally feasible; implement database access controls with least-privilege accounts; enable SQL query logging and anomaly detection; run the application behind a reverse proxy with input validation and sanitization.

Threat Intelligence Overview

EPSS Score

0.1%

Top 80% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.