Simple Pizza Ordering System CVE-2025-6362

Despite the 'critical' classification in the description, the CVSS score of 7.3 (High, not Critical) reflects a realistic threat level. The attack vector is Network (AV:N), attack complexity is Low (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N), indicating maximum accessibility for remote attackers. The impact is moderate across confidentiality, integrity, and availability (C:L, I:L, A:L), allowing data theft, modification, and potential service disruption. The absence of scope change (S:U) limits the blast radius. Without stated KEV (Known Exploited Vulnerability) status, POC availability, or EPSS data in the provided intelligence, the real-world exploitation probability cannot be quantified. However, SQL injection in widely-deployed PHP applications historically sees rapid weaponization. The combination of network accessibility and trivial exploitation complexity suggests this vulnerability presents a HIGH priority for remediation, particularly for internet-facing instances.

An attacker identifies the Simple Pizza Ordering System 1.0 running on a target's web server by accessing /editpro.php. The attacker crafts a malicious HTTP request with a SQL injection payload in the ID parameter, such as GET /editpro.php?ID=1' UNION SELECT user(),database(),version()-- or ID=1'; DROP TABLE products;--. Since the endpoint accepts network requests without authentication (PR:N) and has low complexity (AC:L), the attacker immediately receives database information (confidentiality breach) or executes destructive commands (integrity/availability impact). A realistic attack chain: reconnaissance → payload crafting → injection → data exfiltration of customer orders, payment information, or admin credentials → lateral movement or service disruption. No POC or KEV data provided, but given the simplicity of SQL injection exploitation, automated tools and public exploits are likely to emerge rapidly if not already available.