Which versions of PHP are affected by CVE-2025-6359?

A publicly disclosed SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows unauthenticated remote attackers to compromise database integrity and extract sensitive customer data.

Is there a public PoC exploit available for CVE-2025-6359?

Yes, a public proof-of-concept exploit is available for CVE-2025-6359. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6359?

Within 24 hours: Inventory all systems running Simple Pizza Ordering System 1.0 and isolate affected instances from production if operationally feasible; enable enhanced logging on database access. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the transactioncode parameter of /cashconfirm.php; consider disabling the payment confirmation feature if business operations allow. Within 30 days: Plan migration to patched version or alternative vendor solution; conduct forensic audit of database access logs for signs of exploitation.

PHP CVE-2025-6359

Q: What is the CVSS score of CVE-2025-6359?

CVE-2025-6359 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-18783 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Simple Pizza Ordering System Carmelo

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18783

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 12:59 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 19:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cashconfirm.php. The manipulation of the argument transactioncode leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

Technical ContextAI

This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically SQL injection. The /cashconfirm.php endpoint fails to properly sanitize or parameterize the 'transactioncode' user input before incorporating it into SQL queries. The affected product is code-projects Simple Pizza Ordering System 1.0, a PHP-based web application (CPE: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*). The root cause is insufficient input validation and lack of prepared statements or parameterized queries, allowing attackers to inject SQL metacharacters and manipulate query logic.