Listen to this Post
How the CVE Works
The vulnerability exists in the `/tablelow.php` file of Restaurant Order System 1.0 where improper sanitization of the `ID` parameter allows SQL injection. Attackers can craft malicious SQL queries by manipulating this parameter, enabling unauthorized database access, data exfiltration, or system compromise. The flaw is remotely exploitable without authentication, making it critical. Public exploit code exists, increasing attack likelihood. The vulnerability stems from direct concatenation of user input into SQL statements without prepared statements or input validation.
DailyCVE Form
Platform: Restaurant Order System
Version: 1.0
Vulnerability: SQL Injection
Severity: Critical
Date: 06/24/2025
Prediction: Patch by 07/15/2025
What Undercode Say
SELECT FROM orders WHERE id='[bash]';
exploit = "1' UNION SELECT 1,2,3,4,user(),6-- -"
curl http://target/tablelow.php?ID=1%27%20OR%201%3D1--
How Exploit
Remote unauthenticated SQLi via `ID` parameter.
Protection from this CVE
Update to patched version.
Use prepared statements.
Input validation.
Impact
Data theft possible.
Full system compromise.
Unauthorized access.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
