CVE-2025-13290: Simple Food Ordering System SQLi Flaw

CVE-2025-13290 Overview

CVE-2025-13290 is a SQL injection vulnerability in code-projects Simple Food Ordering System 1.0. The flaw resides in the /saveorder.php endpoint, where the ID parameter is passed to a backend SQL query without proper sanitization. An authenticated remote attacker can manipulate the ID argument to inject arbitrary SQL statements. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed deployments. The issue is tracked under [CWE-89] (SQL Injection) and [CWE-74] (Improper Neutralization of Special Elements).

Critical Impact
Remote attackers with low privileges can manipulate database queries through /saveorder.php, potentially exposing or altering order records stored by the application.

Affected Products

Fabian Simple Food Ordering System 1.0
Component: saveorder.php
CPE: cpe:2.3:a:fabian:simple_food_ordering_system:1.0:*:*:*:*:*:*:*

Discovery Timeline

2025-11-17 - CVE-2025-13290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13290

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the order-saving workflow of Simple Food Ordering System 1.0. The /saveorder.php script accepts an ID parameter from the client and concatenates it directly into a SQL statement. Because the application lacks input validation and parameterized queries, attackers can break out of the intended query context. Successful injection allows reading, modifying, or deleting data within the underlying database. The application's authentication requirement limits exposure to users with valid low-privilege accounts, but registration flows in similar PHP shopping systems are often open to the public.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The ID argument received by saveorder.php is interpolated into a query string without prepared statements, parameter binding, or type casting. Any single quote, comment marker, or UNION-style payload supplied by the client is interpreted as SQL syntax by the database engine.

Attack Vector

The attack is remote and network-based. An attacker submits a crafted HTTP request to /saveorder.php containing a malicious ID value. Typical payloads include boolean-based, error-based, or UNION SELECT techniques to extract data from MySQL tables. No social engineering or user interaction is required beyond an authenticated session.

No verified exploit code is published in the referenced advisories. See the GitHub Issue Tracker and VulDB CVE Analysis for additional technical context.

Detection Methods for CVE-2025-13290

Indicators of Compromise

HTTP POST or GET requests to /saveorder.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the ID parameter.
Unexpected database errors logged by PHP or MySQL referencing saveorder.php execution.
Anomalous order records, duplicated rows, or unauthorized modifications in the application's order tables.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting the ID parameter on /saveorder.php.
Enable verbose query logging on the backend MySQL instance and alert on syntax errors or queries containing boolean tautologies.
Correlate authenticated session activity with abnormal query volume or response time spikes on the order-saving endpoint.

Monitoring Recommendations

Forward web server access logs and database audit logs to a centralized SIEM for correlation across user sessions and source IPs.
Track HTTP 500 responses and SQL error strings returned from /saveorder.php as early indicators of probing.
Alert on requests where the ID parameter contains non-numeric characters, since legitimate values should be integers.

How to Mitigate CVE-2025-13290

Immediate Actions Required

Restrict public access to the Simple Food Ordering System 1.0 deployment until a fix is applied, using network ACLs or authentication proxies.
Implement a WAF rule blocking SQL injection payloads targeting the ID parameter on /saveorder.php.
Audit the application database for unauthorized modifications, suspicious order entries, or signs of data exfiltration.

Patch Information

No official vendor patch is referenced in the NVD entry or VulDB advisory at the time of publication. Administrators should monitor the Code Projects Resource Hub and the VulDB #332631 entry for updates. Until a fix is released, apply manual code remediation by replacing the vulnerable query with a prepared statement using PDO or MySQLi parameter binding, and cast ID to an integer before use.

Workarounds

Modify saveorder.php to use parameterized queries (PDO::prepare with bound parameters) and validate that ID is a positive integer.
Apply least-privilege principles to the database account used by the application, removing DROP, ALTER, and FILE privileges.
Place the application behind a reverse proxy that strips or rejects requests containing SQL metacharacters in query parameters.

bash

# Example WAF rule (ModSecurity) blocking SQLi on saveorder.php ID parameter
SecRule REQUEST_URI "@beginsWith /saveorder.php" \
    "chain,phase:2,deny,status:403,id:1013290,msg:'CVE-2025-13290 SQLi attempt'"
    SecRule ARGS:ID "@rx (?i)(union\s+select|or\s+1=1|--|';|sleep\(|benchmark\()" \
        "t:none,t:urlDecode"