Online Ordering System
CVE-2025-8236
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network attack, no auth or interaction, low impact on all CIA.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in code-projects Online Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit_product.php. The manipulation of the argument Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in the admin edit_product.php page of the code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries. A publicly available exploit increases risk, though EPSS score is low (0.07%) and no active exploitation has been confirmed in CISA KEV. Attackers can extract or modify data with low impact on confidentiality, integrity, and availability.
Technical ContextAI
The vulnerability is a classic SQL injection (CWE-74) in a PHP-based web application. The affected file, /admin/edit_product.php, processes the 'Name' argument without proper sanitization or parameterized queries, allowing attackers to inject arbitrary SQL commands. The CPE string cpe:2.3:a:fabian:online_ordering_system:1.0:*:*:*:*:*:*:* confirms version 1.0 as the only affected version. The root cause is failure to apply input validation or prepared statements, common in custom PHP applications.
RemediationAI
No official vendor patch has been released as of the analysis date. The primary mitigation is to upgrade to a patched version if one becomes available (monitor code-projects.org). For immediate protection, implement input validation and parameterized queries for the 'Name' parameter in /admin/edit_product.php. As a workaround, restrict network access to the admin panel (e.g., IP whitelisting or VPN) or disable the edit_product.php functionality altogether if not essential. These controls may impact administrative workflow but block exploitation. Additionally, use a web application firewall (WAF) with SQL injection rules as a compensating control, though this may introduce false positives.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today