EUVD-2025-18850Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | The CVSS 3.1 score of 7.3 (High) reflects significant real-world risk. Breaking down the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L): Network accessibility (AV:N), low attack complexity (AC:L), and no privilege requirements (PR:N) mean any Internet user can exploit this instantly. The integrity and availability impacts (I:L, A:L) indicate data manipulation and potential denial-of-service via database queries. The public disclosure combined with available exploit code significantly elevates real-world exploitation probability. This is not a theoretical high-CVSS scenario—it represents an immediately exploitable, authentication-bypass vulnerability in a production-facing application. Organizations running this software face imminent risk. |
| Exploit ScenarioDerived | An attacker discovers the Simple Pizza Ordering System running on a target domain. They identify the /edituser.php endpoint and craft a malicious request with an injected SQL payload in the ID parameter, such as: GET /edituser.php?ID=1' OR '1'='1 or ID=1; DROP TABLE users;--. Since the application lacks input sanitization and uses string concatenation in SQL queries, the injected SQL is executed directly against the database. The attacker can: (1) bypass authentication to access or modify any user record, (2) extract sensitive data (user credentials, order history, payment information), or (3) manipulate database structure to cause denial of service. Given the public disclosure and available POC code, script-kiddies and automated scanners will likely attempt exploitation within hours of advisory publication. An e-commerce environment running this software could suffer rapid data exfiltration and loss of operational availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from improper input validation in a PHP-based web application (CPE: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*). The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), which encompasses SQL injection attacks. The /edituser.php file fails to properly sanitize or parameterize the ID parameter before using it in SQL queries. This allows attackers to inject malicious SQL syntax that alters query logic, bypassing authentication or data access controls. The vulnerability is network-accessible without requiring authentication (AV:N/PR:N), making it trivial to reach from the internet.
Know when Simple Pizza Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in code-projects Simple Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edituser.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows remote attackers to compromise database integrity and access sensitive customer data without authentication. Organizations running this application face immediate risk of data breach and operational disruption, particularly affecting customer records and order information.
Within 24 hours: Identify all systems running Simple Pizza Ordering System 1.0 and isolate them from production networks if possible; enable enhanced logging on affected systems. Within 7 days: Deploy Web Application Firewall rules to block SQL injection patterns targeting /edituser.php; conduct database access audit for suspicious activity since disclosure. Within 30 days: Replace Simple Pizza Ordering System with a patched or alternative solution; perform forensic analysis to determine if exploitation has occurred.
Deploy WAF rules to block SQL injection payloads in ID parameter of /edituser.php; restrict network access to application via IP whitelist or VPN; disable /edituser.php endpoint if functionality is non-critical; implement database query logging and anomaly detection; apply principle of least privilege to database user credentials; consider application retirement pending vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Simple Pizza Ordering System
View allA SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affec
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.ph
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID paramete
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' pa
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endp
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affec
Exploit-DB