CVE-2025-11604
📋 TL;DR
CVE-2025-11604 is a SQL injection vulnerability in projectworlds Online Ordering Food System 1.0 that allows attackers to manipulate database queries through the Status parameter in /all-orders.php. This affects all users running this specific software version, potentially enabling unauthorized data access or modification. Remote exploitation is possible without authentication.
💻 Affected Systems
- projectworlds Online Ordering Food System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to order data, customer information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement input validation and parameterized queries in the source code.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting /all-orders.php
Input Validation
allAdd server-side validation for the Status parameter to only accept expected values
🧯 If You Can't Patch
- Restrict network access to the application to trusted IP addresses only
- Implement database user with minimal necessary permissions (principle of least privilege)
🔍 How to Verify
Check if Vulnerable:
Test the /all-orders.php endpoint with SQL injection payloads in the Status parameter (e.g., Status=1' OR '1'='1)Check Version:
Check the software version in the application's admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web server logs
Network Indicators:
- Unusual requests to /all-orders.php with SQL syntax in parameters
SIEM Query:
source="web_server" AND uri="/all-orders.php" AND (param="Status" AND value MATCHES "[';]|OR|UNION|SELECT")