Food Review System CVE-2025-8165

CRITICAL CONDITION: Attacker must possess valid administrative or authenticated user credentials to access the /admin/approve_reservation.php endpoint (CVSS PR:L). No unauthenticated remote exploitation is possible. The occasion parameter must accept user input without validation or prepared statement protection. Default deployments of Food Review System 1.0 are assumed vulnerable if no security patches have been applied. The attack does not require special network conditions (AV:N/AC:L), but does require the attacker to have reached the authenticated admin interface. Exploitation is limited by the application's database privileges; if the database user running the application has restricted permissions, the attacker cannot exfiltrate data outside the application schema or perform system-level operations.

Multiple risk signals conflict in this vulnerability. The source database classifies it as critical, yet the CVSS 4.0 vector yields only 2.1-a stark discrepancy that demands scrutiny. The CVSS vector PR:L (login required) and limited scope constraints (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N) indicate an authenticated attacker can only read/modify application data, not gain system-level control or affect confidentiality of resources outside the vulnerable component. The EPSS score of 0.06% (20th percentile) suggests minimal real-world exploitation probability despite public POC availability, indicating either limited deployment, targeted usage, or that the exploit requires specific conditions not widely met. The presence of publicly available exploit code (E:P in vector) is a positive signal for rapid mass exploitation, but the low EPSS contradicts this. VERDICT: This is a real vulnerability in a niche product with limited user base; the critical classification appears overstated relative to actual technical impact. Organizations running Food Review System 1.0 should patch, but this is not a high-priority emergency for most enterprises.

An authenticated administrative user with legitimate access to the Food Review System visits the reservation approval interface and supplies a malicious SQL payload in the occasion field (e.g., occasion=' OR '1'='1' UNION SELECT username, password FROM admin_users--). The unvalidated input is concatenated into a SQL query, executing the attacker's injected SQL and allowing extraction of sensitive data (user credentials, customer information) or modification of reservation records. Exploitation requires existing authentication credentials, limiting the threat to insider threats or cases where an attacker has already compromised a low-privilege user account.