Simple Pizza Ordering System CVE-2025-6361

This vulnerability presents HIGH real-world risk despite being remotely exploitable without authentication. CVSS 7.3 (AV:Network, AC:Low, PR:None, UI:None) indicates ease of exploitation—no special access, low complexity, and no user interaction required. The attack vector is network-accessible, making it exploitable from the internet. The impact scope is limited to the target system (Confidentiality:Low, Integrity:Low, Availability:Low), suggesting partial data compromise rather than full system takeover. However, SQL injection in an ordering system typically exposes customer PII (names, addresses, phone numbers, payment data), which elevates business risk beyond the CVSS score. No KEV/CISA status or EPSS probability data is provided, but the simplicity of SQL injection exploitation and the public nature of the vulnerability description suggest active exploitation is likely. The lack of authentication requirement and the predictable nature of PHP ordering systems make this a priority threat for immediate patching.

An attacker discovers the Simple Pizza Ordering System running on a target website and identifies the /adds.php endpoint (common path discovery via directory enumeration or source code exposure). The attacker crafts a malicious HTTP request with SQL injection payload in the userid parameter, e.g., 'GET /adds.php?userid=1 OR 1=1 UNION SELECT password FROM users--'. Since no authentication is required (PR:N in CVSS) and AC is Low, the attacker can immediately execute this request from any network location. The backend PHP application concatenates the unsanitized userid directly into a SQL query (e.g., 'SELECT * FROM orders WHERE userid=' . $_GET['userid']), resulting in SQL execution of the attacker's injected clause. The attacker extracts customer records, payment information, or modifies order data. In a more severe scenario, the attacker uses 'INTO OUTFILE' or similar directives to write a web shell to the server, achieving remote code execution. No POC is referenced in the provided data, but SQL injection in PHP is trivial to exploit and POCs are readily available in public databases.