Simple Pizza Ordering System CVE-2025-6357

Multiple risk signals converge to indicate HIGH real-world priority: (1) CVSS 7.3 (High) with network-accessible attack vector (AV:N), low complexity (AC:L), and no authentication required (PR:N) makes exploitation trivial; (2) Public POC disclosure dramatically increases attack likelihood; (3) The vulnerability impacts confidentiality, integrity, and availability (C:L/I:L/A:L) simultaneously; (4) In SSVC framework terms: exploitation is ACTIVE (POC exists), likely automatable via SQL injection tools, and technical impact is TOTAL (payment systems handling sensitive data); (5) This is not a 'high-CVSS-low-risk' edge case—this represents immediate, exploitable, and profitable threat actor interest. The combination of unauthenticated remote access, payment system context, and disclosed POC makes this a critical priority despite the 'medium-high' rather than critical CVSS number.

An attacker crafts a malicious HTTP request to the vulnerable endpoint: GET /paymentportal.php?person=admin' OR '1'='1 or POST with person=1; DROP TABLE customers;--. Due to AC:L and PR:N properties, no authentication or sophisticated techniques required. The attacker exploits the lack of input sanitization to break out of the intended SQL query context and inject arbitrary commands. With database privileges on the web application account, the attacker can extract payment card data, customer PII, and transaction records; modify order histories to hide fraudulent transactions; or delete audit logs. Public POC availability means script kiddies and organized fraud groups can immediately weaponize this—expect scanning for /paymentportal.php instances within hours of POC release. In payment system context, even brief data exposure could trigger regulatory notifications (PCI-DSS, GDPR) and financial liability.