What is the CVSS score of CVE-2025-6363?

CVE-2025-6363 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-6363?

A SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive customer data.

Is there a public PoC exploit available for CVE-2025-6363?

Yes, a public proof-of-concept exploit is available for CVE-2025-6363. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6363?

Within 24 hours: Isolate affected systems from production networks or disable the /adding-exec.php endpoint if operationally feasible. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting the 'ingname' parameter, and implement strict input validation. Within 30 days: Identify and transition to an alternative, maintained pizza ordering platform or engage developers for a custom patch; conduct forensic audit for evidence of exploitation.

PHP CVE-2025-6363

EUVD-2025-18785 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-20 cna@vuldb.com

PHP SQLi Simple Pizza Ordering System RCE

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2025-18785

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Jul 02, 2025 - 18:56 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 20:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /adding-exec.php. The manipulation of the argument ingname leads to sql injection. It is possible to launch the attack remotely.

AnalysisAI

CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.

Technical ContextAI

The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which indicates insufficient input validation/sanitization of the 'ingname' parameter before it is incorporated into SQL query construction. The affected application is code-projects Simple Pizza Ordering System 1.0 (CPE identifier likely: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*), a PHP-based web application. The vulnerable endpoint /adding-exec.php processes ingredient name submissions without parameterized queries or prepared statements, allowing attackers to inject malicious SQL syntax that the database interprets as code rather than data. This is a classic first-order SQL injection vulnerability where user-controlled input flows directly into query execution.

RemediationAI

primary: Upgrade to a patched version >1.0 if available from code-projects; verify vendor release notes or GitHub repository for security patches.; code_fix: Implement prepared statements/parameterized queries in /adding-exec.php. Replace direct SQL concatenation with parameterized prepared statements (e.g., using MySQLi prepared statements or PDO with bound parameters).; input_validation: Validate and sanitize the 'ingname' parameter: use whitelisting (alphanumeric + safe characters), enforce length limits, and apply database-specific escaping (e.g., mysqli_real_escape_string) as a secondary measure (not primary defense).; web_application_firewall: Deploy WAF rules to block SQL injection patterns in the ingname parameter (e.g., detection of SQL keywords: UNION, SELECT, DROP, etc.).; database_access_control: Run the application database user account with minimal privileges (no ALTER/DROP permissions; SELECT/INSERT/UPDATE only on necessary tables).; monitoring: Log and alert on SQL errors in /adding-exec.php; monitor for unusual query patterns indicative of injection attempts.