EUVD-2025-18785
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability, which was classified as critical, was found in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /adding-exec.php. The manipulation of the argument ingname leads to sql injection. It is possible to launch the attack remotely.
Analysis
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.
Technical Context
The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which indicates insufficient input validation/sanitization of the 'ingname' parameter before it is incorporated into SQL query construction. The affected application is code-projects Simple Pizza Ordering System 1.0 (CPE identifier likely: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*), a PHP-based web application. The vulnerable endpoint /adding-exec.php processes ingredient name submissions without parameterized queries or prepared statements, allowing attackers to inject malicious SQL syntax that the database interprets as code rather than data. This is a classic first-order SQL injection vulnerability where user-controlled input flows directly into query execution.
Affected Products
Simple Pizza Ordering System (['1.0'])
Remediation
primary: Upgrade to a patched version >1.0 if available from code-projects; verify vendor release notes or GitHub repository for security patches.; code_fix: Implement prepared statements/parameterized queries in /adding-exec.php. Replace direct SQL concatenation with parameterized prepared statements (e.g., using MySQLi prepared statements or PDO with bound parameters).; input_validation: Validate and sanitize the 'ingname' parameter: use whitelisting (alphanumeric + safe characters), enforce length limits, and apply database-specific escaping (e.g., mysqli_real_escape_string) as a secondary measure (not primary defense).; web_application_firewall: Deploy WAF rules to block SQL injection patterns in the ingname parameter (e.g., detection of SQL keywords: UNION, SELECT, DROP, etc.).; database_access_control: Run the application database user account with minimal privileges (no ALTER/DROP permissions; SELECT/INSERT/UPDATE only on necessary tables).; monitoring: Log and alert on SQL errors in /adding-exec.php; monitor for unusual query patterns indicative of injection attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today