CVE-2025-2387
📋 TL;DR
This critical SQL injection vulnerability in SourceCodester Online Food Ordering System 2.0 allows remote attackers to execute arbitrary SQL commands via the 'pid' parameter in the /admin/ajax.php endpoint. Attackers can potentially access, modify, or delete database content, including sensitive customer and order information. All deployments of version 2.0 are affected.
💻 Affected Systems
- SourceCodester Online Food Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, authentication bypass, or remote code execution via database functions.
Likely Case
Data exfiltration of customer information, order details, and administrative credentials stored in the database.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation and Sanitization
PHPImplement strict input validation and parameterized queries for the 'pid' parameter in ajax.php
Modify /admin/ajax.php to use prepared statements: $stmt = $conn->prepare('INSERT INTO cart (pid) VALUES (?)'); $stmt->bind_param('s', $_POST['pid']);
Web Application Firewall Rules
allBlock SQL injection patterns targeting the /admin/ajax.php endpoint
WAF rule: deny requests to /admin/ajax.php containing SQL keywords like UNION, SELECT, INSERT, DELETE in parameters
🧯 If You Can't Patch
- Block external access to /admin/ajax.php endpoint at network perimeter
- Implement strict database user permissions with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Test the /admin/ajax.php endpoint with SQL injection payloads in the 'pid' parameter and observe database errors or unexpected behavior.Check Version:
Check application version in admin panel or review source code for version markers.Verify Fix Applied:
Attempt SQL injection after implementing fixes and verify no database errors or unauthorized data access occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /admin/ajax.php with SQL keywords in parameters
- Unexpected database queries from web application user
Network Indicators:
- HTTP POST requests to /admin/ajax.php containing SQL injection patterns
- Unusual database traffic patterns from web server
SIEM Query:
source="web_logs" AND uri="/admin/ajax.php" AND (param="pid" AND value MATCHES "(?i)(union|select|insert|delete|drop|--|#)")