EUVD-2025-18786CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, has been found in code-projects Simple Pizza Ordering System 1.0. This issue affects some unknown processing of the file /editpro.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely.
Analysis
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.
Technical Context
The vulnerability stems from improper input validation in the /editpro.php file, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The ID parameter is processed without sufficient sanitization or parameterized query protection, allowing attackers to inject malicious SQL syntax. This is a classic SQL injection flaw where user-supplied input is directly concatenated into SQL queries rather than using prepared statements or parameterized queries. The affected product is code-projects Simple Pizza Ordering System 1.0, a PHP-based web application. The vulnerable endpoint suggests product management functionality (likely product editing), exposing the application's database interface to direct manipulation.
Affected Products
code-projects Simple Pizza Ordering System version 1.0. Estimated CPE: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*. The vulnerability specifically affects the /editpro.php endpoint processing the ID parameter. No other versions or vendor advisories are referenced in the provided intelligence.
Remediation
1. **Immediate**: If still in use, disable or restrict access to /editpro.php via firewall/WAF rules or web server configuration until patched. 2. **Short-term**: Upgrade to a patched version of Simple Pizza Ordering System if available from code-projects (no specific patched version provided in intelligence; contact vendor). 3. **Code-level fix**: Replace all direct SQL query concatenation with parameterized queries or prepared statements using mysqli prepared statements or PDO with bound parameters. Example: Use `$stmt = $pdo->prepare('SELECT * FROM products WHERE id = ?'); $stmt->execute([$id]);` instead of `$query = "SELECT * FROM products WHERE id = $id";`. 4. **Input validation**: Implement strict whitelist validation for the ID parameter (numeric type-casting if ID should be an integer). 5. **Defense-in-depth**: Deploy a Web Application Firewall (WAF) with SQL injection detection rules, enable database activity monitoring, and implement principle of least privilege for database user accounts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today