CVE-2025-10400: Food Ordering Management System SQLi Flaw

CVE-2025-10400 Overview

CVE-2025-10400 is a SQL injection vulnerability in SourceCodester Food Ordering Management System 1.0. The flaw resides in the /routers/ticket-message.php script, where the ticket_id parameter is passed to a database query without proper sanitization. Authenticated remote attackers can manipulate the parameter to inject arbitrary SQL statements. The exploit details have been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed deployments. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-74 (Improper Neutralization of Special Elements in Output).

Critical Impact
Remote attackers with low privileges can inject SQL queries through the ticket_id parameter, exposing confidentiality, integrity, and availability of the underlying database.

Affected Products

Oretnom23 (SourceCodester) Food Ordering Management System 1.0
Component: /routers/ticket-message.php
CPE: cpe:2.3:a:oretnom23:food_ordering_management_system:1.0

Discovery Timeline

2025-09-14 - CVE-2025-10400 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10400

Vulnerability Analysis

The vulnerability exists in the ticket messaging router of the Food Ordering Management System. The ticket-message.php endpoint accepts a ticket_id parameter from the client and concatenates the value into a SQL query without parameterization or input filtering. An authenticated attacker can supply crafted input to alter the query structure. This allows extraction of database contents, modification of ticket records, or enumeration of backend schema.

The issue is reachable over the network. Exploitation requires only low-level privileges (a standard authenticated user) and no user interaction. Because the application handles customer ticket data, the database typically holds personally identifiable information and order records.

Root Cause

The root cause is missing input validation and the absence of prepared statements in the query that handles the ticket_id argument. The PHP code interpolates the user-supplied value directly into the SQL string. This pattern violates secure coding guidance documented in CWE-89.

Attack Vector

An authenticated attacker sends an HTTP request to /routers/ticket-message.php containing a malicious ticket_id value. Typical payloads use boolean-based, time-based, or UNION-based SQL injection techniques to enumerate data. The attack does not require local access, special configuration, or social engineering. Public proof-of-concept material is referenced in the VulDB entry #323835 and the CVE Hunter GitHub issue. No verified exploit code is reproduced here.

Detection Methods for CVE-2025-10400

Indicators of Compromise

HTTP requests to /routers/ticket-message.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- in the ticket_id parameter.
Database error messages or unusually long response times tied to ticket message requests.
Unexpected read or write operations against ticket-related tables by the web application service account.

Detection Strategies

Inspect web server access logs for non-numeric or encoded values supplied to ticket_id.
Deploy a web application firewall ruleset that flags SQL injection signatures against the /routers/ path.
Correlate authenticated session activity with anomalous query volume against the MySQL backend.

Monitoring Recommendations

Enable MySQL general query logging during incident triage to capture queries originating from the application user.
Alert on HTTP 500 responses from ticket-message.php, which often indicate injection probes.
Track repeated requests to ticket endpoints from a single authenticated session within a short interval.

How to Mitigate CVE-2025-10400

Immediate Actions Required

Restrict network exposure of the Food Ordering Management System to trusted users while a fix is evaluated.
Audit the /routers/ticket-message.php source and replace string-concatenated SQL with parameterized queries using PDO or mysqli prepared statements.
Apply input validation to ensure ticket_id only accepts integer values.

Patch Information

No official vendor patch has been published for CVE-2025-10400 at the time of NVD release. Refer to the SourceCodester resource portal and the VulDB advisory for updates.

Workarounds

Place the application behind a web application firewall and enable SQL injection signatures for the ticket router endpoints.
Enforce least-privilege database accounts so the web application user cannot read or modify unrelated tables.
Disable or remove the ticket messaging feature if it is not required for business operations.

bash

# Example Apache mod_security rule to block SQLi in ticket_id
SecRule ARGS:ticket_id "@detectSQLi" \
  "id:1010400,phase:2,deny,status:403,\
   msg:'Possible SQL injection in ticket_id (CVE-2025-10400)',\
   tag:'CVE-2025-10400'"