CVE-2025-6361
📋 TL;DR
This critical SQL injection vulnerability in Simple Pizza Ordering System 1.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter in adds.php. Attackers can potentially access, modify, or delete database content. All deployments of version 1.0 are affected.
💻 Affected Systems
- Simple Pizza Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, privilege escalation, and potential authentication bypass leading to system compromise.
If Mitigated
Limited impact with proper input validation and database permission restrictions.
🎯 Exploit Status
SQL injection via userid parameter requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize userid parameter before processing
Modify adds.php to validate userid as integer using is_numeric() or similar
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: deny requests containing SQL keywords in userid parameter
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from web server
🔍 How to Verify
Check if Vulnerable:
Test adds.php with SQL injection payloads in userid parameter (e.g., userid=1' OR '1'='1)Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify input validation rejects SQL injection attempts and returns proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in web logs
- Multiple failed login attempts via adds.php
- Suspicious userid parameter values
Network Indicators:
- HTTP requests to adds.php with SQL keywords in parameters
- Unusual database query patterns from web server
SIEM Query:
source="web_logs" AND uri="/adds.php" AND (param="userid" AND value MATCHES "(?i)(union|select|insert|update|delete|drop|--|#|;)")