EUVD-2025-18850
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability has been found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edituser.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
Technical Context
This vulnerability stems from improper input validation in a PHP-based web application (CPE: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*). The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which encompasses SQL injection attacks. The /edituser.php file fails to properly sanitize or parameterize the ID parameter before using it in SQL queries. This allows attackers to inject malicious SQL syntax that alters query logic, bypassing authentication or data access controls. The vulnerability is network-accessible without requiring authentication (AV:N/PR:N), making it trivial to reach from the internet.
Affected Products
Simple Pizza Ordering System (['1.0'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today