CVE-2025-11613: Simple Food Ordering System SQLi Flaw

CVE-2025-11613 Overview

CVE-2025-11613 is a SQL injection vulnerability in code-projects Simple Food Ordering System 1.0. The flaw resides in the /addcategory.php script, where the cname parameter is passed to a database query without proper sanitization. Attackers can manipulate the cname argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable over the network and requires low-level authenticated privileges. Public disclosure of the exploit technique has occurred through VulDB and a GitHub issue, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Authenticated remote attackers can inject SQL through the cname parameter of /addcategory.php, enabling unauthorized read and write access to the backend database.

Affected Products

Fabian Simple Food Ordering System 1.0
CPE: cpe:2.3:a:fabian:simple_food_ordering_system:1.0
Component: addcategory.php (cname parameter)

Discovery Timeline

2025-10-11 - CVE-2025-11613 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11613

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization in Output Used by a Downstream Component). The /addcategory.php endpoint accepts a cname argument used to create category records. The application concatenates the user-supplied value directly into an SQL statement without parameterization or input validation. An attacker who can reach the endpoint can therefore alter the query logic. The EPSS probability of exploitation is 0.302% with a percentile of 21.77, reflecting limited automated exploitation activity at present.

Root Cause

The root cause is direct concatenation of untrusted input into a SQL query string. The cname parameter is not escaped, bound as a prepared statement parameter, or filtered against a whitelist. As a result, the SQL parser interprets attacker-controlled syntax as part of the query.

Attack Vector

The attack vector is network-based through an authenticated HTTP request to /addcategory.php. An attacker submits a crafted POST or GET request with a malicious payload in the cname field. Successful injection allows enumeration of database schema, extraction of stored records including credentials, and potentially modification or deletion of data. Because the exploit has been made public through the GitHub Issue Discussion and VulDB #327943, reproduction is straightforward.

No verified proof-of-concept code is republished here. Refer to the public references for technical payload details.

Detection Methods for CVE-2025-11613

Indicators of Compromise

HTTP requests to /addcategory.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or /* in the cname parameter
Unexpected database errors logged by the PHP application or MySQL server referencing the category table
New or modified rows in the category table that do not correspond to legitimate administrative activity
Outbound queries or authentication events originating from the web application account outside normal business hours

Detection Strategies

Deploy web application firewall rules that inspect POST and GET parameters submitted to /addcategory.php for SQL injection signatures
Enable MySQL general query logging in staging or forensic environments to identify anomalous SELECT, UNION, or INFORMATION_SCHEMA references tied to category creation flows
Correlate web server access logs with database error logs to surface repeated injection attempts against the same session or source IP

Monitoring Recommendations

Alert on multiple 500-series responses from /addcategory.php within a short window from a single client
Monitor for privilege escalation activity on the web application account, such as new administrative users or unexpected password hash changes
Track outbound data volume from the database host to detect large result-set exfiltration following successful injection

How to Mitigate CVE-2025-11613

Immediate Actions Required

Restrict access to /addcategory.php to trusted administrative networks using IP allowlisting or VPN gating until a patch is available
Revoke or rotate credentials for any account that could have been exposed through the vulnerable category management workflow
Audit the category table and related tables for unauthorized entries or modifications

Patch Information

No official vendor patch has been published for Simple Food Ordering System 1.0 at the time of this writing. Organizations running this application should treat it as unmaintained and evaluate migration to an actively supported alternative. Consult the Code Projects Resource Hub and VulDB #327943 CTI for status updates.

Workarounds

Modify addcategory.php to use parameterized queries via PDO or mysqli prepared statements instead of string concatenation
Apply server-side input validation that restricts cname to a whitelist of alphanumeric characters and spaces
Deploy a web application firewall with SQL injection rulesets in blocking mode in front of the application
Run the MySQL service account with least privilege, removing DDL and file access rights that are not required for normal application function

bash

# Example WAF-style ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@streq /addcategory.php" \
  "phase:2,chain,deny,status:403,id:1011613,msg:'Potential SQLi in cname parameter'"
  SecRule ARGS:cname "@rx (?i)(union(\s|/\*)+select|--|/\*|;|\bor\b\s+1=1)" "t:none,t:urlDecodeUni"