Simple Pizza Ordering System EUVD-2025-28727

While the CVSS 3.1 score of 7.3 (High) reflects a serious vulnerability with low attack complexity (AC:L) and no authentication requirements (PR:N), the actual real-world risk is CRITICAL due to converging negative signals: (1) Public POC availability dramatically increases exploitation probability beyond baseline EPSS; (2) SQL injection in an ordering system directly impacts confidentiality (user data, payment information), integrity (order manipulation), and availability (potential database destruction); (3) The attack vector is Network (AV:N) with no user interaction required (UI:N), making large-scale automated exploitation trivial; (4) The vulnerability likely affects production systems handling customer financial data. This is not a false-positive high-CVSS issue—it represents immediate, exploitable danger to affected deployments. SSVC assessment: Exploitation status=Proof-of-Concept (public), Automatable=Yes, Technical Impact=High (data exfiltration, integrity violation). Priority should be CRITICAL/IMMEDIATE.

An attacker discovers the Simple Pizza Ordering System is deployed on a target e-commerce site. They craft a malicious request to /saveorder.php?ID=1' OR '1'='1 (or a more sophisticated UNION-based injection). Because no authentication or complex interaction is required, and the attack is network-accessible, the attacker can immediately execute arbitrary SQL queries. A realistic attack chain: (1) Extract the database schema and table names; (2) Dump user credentials, email addresses, and phone numbers from the users table; (3) Extract payment information or order history; (4) Modify order records to change prices or delivery addresses; (5) Drop tables or corrupt the database to cause denial of service. With public POC code available, even unskilled attackers can execute these steps at scale. A compromised system could lead to data breaches affecting all customers, financial fraud, and reputational damage.