Simple Pizza Ordering System EUVD-2025-28728

CVSS 3.1 score of 7.3 (High) reflects a network-accessible SQL injection with no authentication required (PR:N), low attack complexity (AC:L), and full impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The vector indicates this is trivially exploitable. Critical factors elevating real-world risk: (1) Public disclosure and available POC code dramatically increase likelihood of widespread exploitation; (2) The application appears to be a legacy/unmaintained project based on version 1.0 status, suggesting low patching likelihood; (3) SQL injection is fully automatable and enables lateral movement, privilege escalation, or data exfiltration in production environments. EPSS probability would likely be elevated (>0.97) given public POC availability. This transitions from theoretical to immediate operational risk—especially for any deployments of this ordering system in production, though adoption appears limited given the niche nature. Organizations using this system should treat this as critical-priority.

An attacker discovers a deployment of Simple Pizza Ordering System 1.0 via search engine or network scanning. They craft a malicious URL with SQL injection payload in the ID parameter, e.g., GET /portal.php?ID=1' UNION SELECT user(),database(),version()-- -. The unvalidated parameter flows directly into a SQL query, allowing the attacker to: (1) Extract usernames, password hashes, and customer data from the database; (2) Modify orders or pricing data (integrity attack); (3) Drop tables or disable the application (availability attack). Since this is a pizza ordering system, customer PII (names, addresses, payment info) is likely stored and exposed. With public POC code available, this exploitation is trivial—even low-skilled attackers can execute attacks using standard SQLi tools (sqlmap) or copy-paste payloads. Attack vector is network (AV:N), no authentication needed, and no user interaction required, making large-scale automated scanning and exploitation realistic.