What is the CVSS score of CVE-2025-6362?

CVE-2025-6362 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-6362?

A SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows remote attackers to exploit the /editpro.php file, potentially enabling unauthorized database access, data theft, or system…

Is there a public PoC exploit available for CVE-2025-6362?

Yes, a public proof-of-concept exploit is available for CVE-2025-6362. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6362?

Within 24 hours: Inventory all systems running Simple Pizza Ordering System 1.0 and isolate affected instances from production if possible; implement WAF rules blocking requests to /editpro.php with suspicious parameters. Within 7 days: Apply input validation and parameterized query fixes through code review and hotpatching; consider migrating to alternative ordering systems or containerizing the application with restricted database permissions. Within 30 days: Complete remediation or decommission the vulnerable application; deploy network segmentation to limit database access; conduct forensic analysis for signs of exploitation.

PHP CVE-2025-6362

EUVD-2025-18786 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Simple Pizza Ordering System

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18786

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jun 26, 2025 - 15:30 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, has been found in code-projects Simple Pizza Ordering System 1.0. This issue affects some unknown processing of the file /editpro.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely.

AnalysisAI

CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.

Technical ContextAI

The vulnerability stems from improper input validation in the /editpro.php file, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The ID parameter is processed without sufficient sanitization or parameterized query protection, allowing attackers to inject malicious SQL syntax. This is a classic SQL injection flaw where user-supplied input is directly concatenated into SQL queries rather than using prepared statements or parameterized queries. The affected product is code-projects Simple Pizza Ordering System 1.0, a PHP-based web application. The vulnerable endpoint suggests product management functionality (likely product editing), exposing the application's database interface to direct manipulation.

RemediationAI

Immediate: If still in use, disable or restrict access to /editpro.php via firewall/WAF rules or web server configuration until patched. 2. Short-term: Upgrade to a patched version of Simple Pizza Ordering System if available from code-projects (no specific patched version provided in intelligence; contact vendor). 3. Code-level fix: Replace all direct SQL query concatenation with parameterized queries or prepared statements using mysqli prepared statements or PDO with bound parameters. Example: Use $stmt = $pdo->prepare('SELECT * FROM products WHERE id = ?'); $stmt->execute([$id]); instead of $query = "SELECT * FROM products WHERE id = $id";. 4. Input validation: Implement strict whitelist validation for the ID parameter (numeric type-casting if ID should be an integer). 5. Defense-in-depth: Deploy a Web Application Firewall (WAF) with SQL injection detection rules, enable database activity monitoring, and implement principle of least privilege for database user accounts.