Simple Pizza Ordering System CVE-2025-6479

Multiple risk signals converge to indicate HIGH real-world priority: (1) CVSS 7.3 (High) with AV:N/AC:L/PR:N/UI:N indicates maximum exploitability - network-accessible, low complexity, no privileges or user interaction required; (2) Public disclosure and available POC/exploit code significantly accelerates threat actor adoption; (3) No authentication required (PR:N) means any Internet user can exploit this; (4) SQL injection directly impacts all three security pillars - Confidentiality (data theft), Integrity (data modification), and Availability (denial via database corruption). The CVSS vector shows balanced impact (C:L/I:L/A:L) rather than critical data access, slightly moderating severity, but the ease of exploitation (AC:L) and public POC availability position this as immediately weaponizable. This is NOT a low-real-risk-high-CVSS case; it represents genuine critical infrastructure risk for any pizza ordering business using this system.

An attacker identifies a pizza shop using Simple Pizza Ordering System 1.0 (publicly discoverable via web footprinting/Shodan queries for /salesreport.php). The attacker crafts a malicious HTTP request: GET /salesreport.php?dayfrom=2025-01-01' OR '1'='1 or similar SQL injection payload. Due to lack of input sanitization, the injected SQL executes in the backend database context. The attacker can: (a) extract customer data (names, addresses, phone numbers, order history) via UNION-based injection; (b) modify sales records or prices; (c) execute database commands to escalate privileges or drop tables. No authentication or user interaction is required - a single HTTP request triggers full exploitation. With public POC availability, automated scanners and script kiddies can rapidly identify and exploit vulnerable instances at scale. A realistic scenario: attacker uses automated SQL injection scanner against multiple pizza shop domains, identifies vulnerable instances, and exfiltrates customer PII for identity theft or sale on dark markets.