Simple Pizza Ordering System CVE-2025-6481

This vulnerability presents HIGH real-world risk despite a moderately high CVSS score of 7.3 (rather than critical 9.0+), based on multiple converging factors: (1) Attack Vector: Network with no authentication required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) indicates trivial exploitation from internet without credentials; (2) Public disclosure and available proof-of-concept eliminate the exploitation barrier; (3) SQL injection to a web application database typically enables data exfiltration (Confidentiality), modification (Integrity), and potential denial of service (Availability); (4) The application is a pizza ordering system likely handling customer PII, payment details, and order information—high-value targets; (5) SSVC classification would likely yield 'Scheduled' or 'Out-of-cycle' patch urgency given public exploitation and automatable attacks. However, CVSS Impact scores show only Low impact (C:L/I:L/A:L), suggesting either sandboxed databases or defensive layering. Organizations using this system should treat this as urgent priority, but impact is constrained by application isolation and data sensitivity.

An attacker discovers the Simple Pizza Ordering System 1.0 deployed at a restaurant's public website (e.g., pizzeria.com/menu). The attacker crafts a malicious HTTP request: GET /update.php?ID=1' OR '1'='1 HTTP/1.1. The application concatenates this unsanitized ID directly into a SQL query (e.g., SELECT * FROM orders WHERE ID = 1' OR '1'='1), causing the database to return all orders regardless of ID. Using UNION-based injection (e.g., ID=1 UNION SELECT user(),database(),version()--), the attacker extracts database credentials, customer data, and payment information. Because PR:N and UI:N in CVSS indicate no authentication or user interaction required, the attacker performs this entirely remotely and automatically. Public proof-of-concept tools enable script-kiddie-level exploitation. The attack is fully automated and undetectable without WAF/IDS signatures, making it a high-likelihood scenario for exposed instances.