Food Ordering Review System CVE-2025-8018

An attacker must possess valid authentication credentials to the Food Ordering Review System application. The attack vector is triggered when an authenticated user directly manipulates the reg_Id parameter, typically through HTTP GET or POST requests to /user/reservation_page.php. No special configuration or non-default setup is required beyond a standard PHP-based deployment. The SQL injection payload is user-controllable, so an attacker can craft malicious input during any legitimate request to this endpoint. Exploitation does not require elevated privileges beyond standard user-level access to the application. Limitations: the attacker cannot execute complex multi-statement SQL queries or access operating system functions if the database is properly configured with restricted permissions, and the impact is constrained to confidentiality and integrity of application data rather than system-wide compromise.

This vulnerability presents a discordant risk profile: the description claims 'critical' severity and the CVE is tagged as SQL injection, yet the CVSS 4.0 vector yields a score of only 2.1 with multiple limiting factors. The vector shows AV:N (network-accessible) and AC:L (low complexity), but critically requires PR:L (authenticated attacker) and grants only L-level impact to confidentiality, integrity, and availability with no scope change. EPSS score of 0.02% (5th percentile) strongly indicates minimal real-world exploitation probability despite public POC availability. The discrepancy between the critical declaration and low CVSS/EPSS scores suggests either: (1) the initial assessment was overstated, or (2) the authentication requirement and limited impact significantly reduce practical risk compared to typical SQL injection. Given the authentication gate and restricted impact permissions in the CVSS vector, this is a low-priority vulnerability for most organizations running this niche food ordering application. However, authenticated insiders or attackers with valid credentials present a realistic threat for data exfiltration.

An authenticated user of the Food Ordering Review System crafts a malicious SQL injection payload in the reg_Id parameter (e.g., reg_Id=1' OR '1'='1) when accessing the /user/reservation_page.php endpoint. The unsanitized input is concatenated into a backend SQL query, causing the database to execute attacker-controlled SQL syntax. This allows the attacker to bypass intended query logic, extract sensitive data from reservation or user tables, or modify records. Public exploit code on GitHub demonstrates this technique, though actual exploitation remains rare in practice given the system's narrow deployment footprint.