What is the CVSS score of CVE-2025-6361?

CVE-2025-6361 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-6361?

A remote SQL injection vulnerability exists in Simple Pizza Ordering System 1.0 that could allow attackers to access, modify, or delete customer data and system information without authentication.

Is there a public PoC exploit available for CVE-2025-6361?

Yes, a public proof-of-concept exploit is available for CVE-2025-6361. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6361?

Within 24 hours: Isolate affected systems from production if possible and disable the /adds.php endpoint or restrict access via network controls; notify relevant stakeholders and conduct inventory of all instances running this software. Within 7 days: Deploy WAF rules to block malicious userid parameter patterns; implement input validation and parameterized queries at the application layer if source code access is available; review logs for exploitation attempts. Within 30 days: Evaluate alternative ordering systems or migrate to patched/supported software; conduct forensic analysis to determine if the vulnerability was exploited; implement mandatory code review and security testing processes for future deployments.

PHP CVE-2025-6361

EUVD-2025-18784 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Simple Pizza Ordering System

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18784

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 15:33 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Simple Pizza Ordering System 1.0. This vulnerability affects unknown code of the file /adds.php. The manipulation of the argument userid leads to sql injection. The attack can be initiated remotely.

AnalysisAI

CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-74: Improper Neutralization of Special Elements used in an Output ('Injection')) occurring in PHP application code. The /adds.php endpoint fails to properly sanitize or parameterize the 'userid' parameter before incorporating it into SQL queries, allowing attackers to inject malicious SQL syntax. This is a fundamental input validation failure common in legacy PHP applications that predate modern prepared statement adoption. The affected product is code-projects Simple Pizza Ordering System 1.0, a lightweight PHP-based ordering platform. The vulnerability stems from direct string concatenation of user input into SQL query construction without escaping, type casting, or prepared statement usage.

RemediationAI

Immediate Actions: (1) Disable or remove the /adds.php endpoint if not actively required for operations; (2) Implement Web Application Firewall (WAF) rules to block SQL injection patterns in userid parameter; (3) Apply input validation to reject non-numeric userid values if integer expected. Long-term Fixes: (1) Upgrade to the latest patched version of Simple Pizza Ordering System (version/patch availability not specified in references—contact code-projects vendor directly); (2) If no patch is available, refactor /adds.php to use prepared statements/parameterized queries with bound parameters instead of string concatenation; (3) Implement principle of least privilege for database connection credentials; (4) Enable SQL error suppression to prevent information disclosure; (5) Deploy database activity monitoring to detect exploitation attempts. Vendor Advisory: Contact code-projects for security patch availability at their official support channels. No official CVE patch reference provided—escalate to vendor for timeline.