EUVD-2025-18783Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | While the CVSS 3.1 score of 7.3 indicates high severity (attack vector network, low complexity, no privileges required, no user interaction), several factors elevate real-world risk: (1) Public exploit disclosure means attack code is widely available, (2) the vulnerability affects unauthenticated users (PR:N), (3) the attack is easily automatable (AC:L), and (4) SQL injection provides broad technical impact (confidentiality, integrity, availability). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L confirms remote, low-barrier exploitation. This is a genuine high-priority vulnerability suitable for emergency patching, not a false-positive inflated CVSS score. Any deployment of Simple Pizza Ordering System 1.0 exposed to untrusted networks should be treated as compromised. |
| Exploit ScenarioDerived | An attacker identifies a Simple Pizza Ordering System 1.0 instance (e.g., via web scanning or public database) and crafts a malicious HTTP request: GET /cashconfirm.php?transactioncode=1' UNION SELECT user(), database(), version()-- . The unescaped 'transactioncode' is injected directly into the SQL query, allowing the attacker to extract database credentials, enumerate tables, or pivot to command execution. Because AV:N and PR:N, the attacker requires no authentication or credentials. With AC:L and UI:N, the attack succeeds in seconds with automated tools. If PoC code is public (as indicated in the CVE description), widespread automated scanning and exploitation by both opportunistic and targeted threat actors is likely. A pizza ordering system likely stores customer payment data (PCI-DSS scope), credit card information, and personal details—making this a data breach vector as well as a system compromise risk. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically SQL injection. The /cashconfirm.php endpoint fails to properly sanitize or parameterize the 'transactioncode' user input before incorporating it into SQL queries. The affected product is code-projects Simple Pizza Ordering System 1.0, a PHP-based web application (CPE: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*). The root cause is insufficient input validation and lack of prepared statements or parameterized queries, allowing attackers to inject SQL metacharacters and manipulate query logic.
Know when Simple Pizza Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cashconfirm.php. The manipulation of the argument transactioncode leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A publicly disclosed SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows unauthenticated remote attackers to compromise database integrity and extract sensitive customer data. Organizations running this application face immediate risk of data breach, particularly affecting customer payment and order information.
Within 24 hours: Inventory all systems running Simple Pizza Ordering System 1.0 and isolate affected instances from production if operationally feasible; enable enhanced logging on database access. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns in the transactioncode parameter of /cashconfirm.php; consider disabling the payment confirmation feature if business operations allow. Within 30 days: Plan migration to patched version or alternative vendor solution; conduct forensic audit of database access logs for signs of exploitation.
Deploy WAF rules to sanitize and block suspicious SQL syntax in the transactioncode parameter; implement input validation that strictly whitelists alphanumeric transaction codes only; segment the database server from untrusted networks; disable direct internet access to /cashconfirm.php and route through authenticated proxy; enable real-time SQL query logging and alerting for anomalous patterns; consider disabling the payment confirmation feature until patch availability; implement database activity monitoring (DAM) to detect unauthorized queries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Simple Pizza Ordering System
View allA SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affec
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.ph
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID paramete
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' pa
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endp
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the
Exploit-DB