EUVD-2025-19593Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /addpro.php with malicious ID
-
ExploitTrigger SQL injection in backend database
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract or modify order data or cause service disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Simple Pizza Ordering System 1.0. The attack requires no user interaction and works over the network. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) indicates a network-exploitable, low-complexity attack with no privileges and low impact on confidentiality, integrity, and availability. EPSS score of 0.06% (19th percentile) suggests very low exploitation likelihood in the wild, and the product is not listed in CISA KEV. While public exploit code exists, the limited impact and low prevalence reduce the real-world urgency. This is a moderate-priority issue, not a critical emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to /addpro.php with a malicious 'ID' parameter containing SQL injection payloads. This could extract database contents, modify orders, or disrupt service availability. Public exploit code is available on GitHub. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
RemediationAI
No vendor-released patch is available at the time of analysis. As a temporary workaround, restrict access to the /addpro.php endpoint via web server rules (e.g., IP whitelisting) to trusted users, or implement Web Application Firewall rules to block SQL injection attempts. If source code modification is feasible, apply input validation and parameterized queries for the 'ID' parameter. Disabling the affected functionality may impact ordering processes. Monitor official channels (code-projects.org) for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in a PHP-based web application (Simple Pizza Ordering System by carmelo) and stems from improper neutralization of special elements in SQL commands (CWE-74 Injection). The file /addpro.php accepts an 'ID' parameter that is likely concatenated directly into a SQL query without parameterized preparation, enabling SQL injection. The affected product is identified by CPE cpe:2.3:a:carmelo:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*.
Know when Simple Pizza Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated attack, low complexity, only low data impact due to SQL injection.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in code-projects Simple Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /addpro.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Simple Pizza Ordering System
View allA SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affec
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.ph
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID paramete
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, speci
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endp
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affec
Exploit-DB