EUVD-2025-28728
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in code-projects Simple Pizza Ordering System 1.0. This affects an unknown part of the file /portal.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /portal.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Technical Context
This is a classic SQL injection vulnerability (CWE-74: Improper Neutralization of Special Elements used in an SQL Command) in a PHP-based web application. The /portal.php endpoint accepts an ID parameter that is directly incorporated into SQL queries without proper input validation or parameterized query preparation. CWE-74 encompasses SQL injection and similar injection attacks where user-controlled input flows unsanitized into command contexts. The vulnerability likely exists in database query construction using string concatenation rather than prepared statements with parameter binding. Affected product: code-projects Simple Pizza Ordering System 1.0 (CPE context suggests a legacy/open-source project management application).
Affected Products
- product: code-projects Simple Pizza Ordering System; versions: 1.0; affected_component: /portal.php (ID parameter); vendor: code-projects; cpe: cpe:2.3:a:code-projects:simple_pizza_ordering_system:1.0:*:*:*:*:*:*:*; status: Unpatched (as of CVE publication)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today