Which versions of PHP are affected by CVE-2025-6356?

A publicly disclosed SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows remote attackers to potentially access, modify, or exfiltrate sensitive database information without…

Is there a public PoC exploit available for CVE-2025-6356?

Yes, a public proof-of-concept exploit is available for CVE-2025-6356. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6356?

Within 24 hours: Identify all instances of Simple Pizza Ordering System 1.0 in production and isolate them from the internet or restrict access to trusted networks only. Within 7 days: Implement WAF rules to block requests to /addmem.php with SQL injection payloads, conduct database access logs review for suspicious activity, and assess what data is accessible through this application. Within 30 days: Either upgrade to a patched version when available, replace the application with a supported alternative, or decommission the system if no patch becomes available.

PHP CVE-2025-6356

Q: What is the CVSS score of CVE-2025-6356?

CVE-2025-6356 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18771 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Simple Pizza Ordering System Carmelo

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18771

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 13:17 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 18:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /addmem.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6356 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /addmem.php file that allows unauthenticated remote attackers to manipulate database queries. An attacker can exploit this vulnerability to read, modify, or delete sensitive data from the underlying database. The vulnerability has public exploit code available and may be actively exploited in the wild.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) occurring in the /addmem.php endpoint of the Simple Pizza Ordering System. The root cause is insufficient input validation and sanitization of user-supplied parameters before they are incorporated into SQL queries. Rather than using parameterized queries or prepared statements, the application directly concatenates user input into SQL command strings. This allows attackers to inject arbitrary SQL syntax to break out of the intended query context and execute malicious database operations. The affected product is identified as code-projects Simple Pizza Ordering System 1.0, a PHP-based web application commonly used for small restaurant ordering platforms.