Simple Pizza Ordering System CVE-2025-6363

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates high exploitability: network-accessible, low attack complexity, no privileges required, and no user interaction needed. The impact is moderate across all three security pillars (confidentiality, integrity, availability). However, the 7.3 CVSS score (High, not Critical despite description) should be contextualized: SQL injection against unauthenticated endpoints in small-scale applications (pizza ordering systems) typically affects limited data sets. Real-world risk depends on: (1) whether POC/exploit code exists publicly (not provided in this analysis); (2) KEV/CISA inclusion status (not provided); (3) EPSS exploitation probability (not provided); and (4) actual deployment prevalence. Given this is version 1.0 of a niche application from code-projects, widespread exploitation is less likely than for popular frameworks, but any deployed instance is trivially compromisable. Prioritize if this system is internet-facing or processes sensitive customer data.

An attacker discovers the Simple Pizza Ordering System deployed at a restaurant's website. They craft a POST/GET request to /adding-exec.php with a malicious payload in the ingname parameter, such as: ingname=cheese' OR '1'='1' -- or ingname=cheese'; DROP TABLE orders; --. The application concatenates this unsanitized input into a SQL query (e.g., INSERT INTO ingredients (name) VALUES ('cheese' OR '1'='1' --)'). The database executes the injected SQL, either returning all ingredient records, modifying data, or deleting tables. An attacker with moderate SQL knowledge can extract customer orders, payment information, or delete the entire database. The attack requires no authentication, no complex exploitation technique, and can be automated via scripts. If POC exists on GitHub or public exploit databases, the risk increases substantially due to lowered technical barriers for script-kiddie-level attacks.