CVE-2025-6363
📋 TL;DR
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0. Attackers can remotely exploit the /adding-exec.php file via the ingname parameter to execute arbitrary SQL commands. All deployments of version 1.0 are affected.
💻 Affected Systems
- code-projects Simple Pizza Ordering System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Database information disclosure, authentication bypass, and data manipulation affecting pizza orders and customer information.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages exposed.
🎯 Exploit Status
SQL injection via ingname parameter is straightforward to exploit. Public references suggest exploit details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the ingname parameter before processing
Modify /adding-exec.php to validate and sanitize user input using prepared statements or parameterized queries
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Remove or restrict access to /adding-exec.php file
- Implement network segmentation to isolate the vulnerable system
🔍 How to Verify
Check if Vulnerable:
Test /adding-exec.php with SQL injection payloads in ingname parameter (e.g., ingname=test' OR '1'='1)Check Version:
Check system documentation or source code for version 1.0 referencesVerify Fix Applied:
Verify input validation is implemented and SQL injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
Network Indicators:
- HTTP POST requests to /adding-exec.php with SQL keywords in parameters
SIEM Query:
web.url:*adding-exec.php* AND (web.param:*OR* OR web.param:*UNION* OR web.param:*SELECT*)