CVE-2025-6122: Restaurant Order System SQLi Vulnerability

CVE-2025-6122 Overview

CVE-2025-6122 is a SQL injection vulnerability in code-projects Restaurant Order System 1.0. The flaw resides in the /table.php script, where the ID parameter is passed directly into a backend SQL query without proper sanitization. An authenticated remote attacker with low privileges can manipulate the ID argument to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Successful exploitation enables attackers to read, modify, or delete records in the underlying database, exposing customer and order data managed by the application.

Affected Products

Fabian Restaurant Order System 1.0
Deployments using the vulnerable /table.php endpoint
Installations exposing the application to untrusted networks

Discovery Timeline

2025-06-16 - CVE-2025-6122 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6122

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output). The /table.php script accepts an ID parameter from the HTTP request and concatenates it into a SQL query string without parameterization or input validation.

An attacker authenticated with low privileges can submit crafted input through the ID parameter to alter the structure of the SQL query. This allows the attacker to retrieve unauthorized data, bypass logical filters, and potentially write to the database. The attack does not require user interaction and can be initiated over the network.

Root Cause

The root cause is the absence of prepared statements or parameterized queries in the handling of the ID argument within /table.php. User-supplied input is interpolated directly into the SQL statement, allowing query syntax to be modified at runtime.

Attack Vector

The attacker sends a crafted HTTP request to /table.php with a malicious ID value containing SQL metacharacters such as ', UNION SELECT, or boolean payloads. Because the application requires low-level authentication, an attacker with a valid low-privilege account, or one obtained through credential stuffing, can reach the vulnerable endpoint. Public proof-of-concept material is referenced in the GitHub PoC Issue #3 and VulDB entry #312591.

// No verified exploit code is published in this advisory.
// Refer to the linked PoC and VulDB references for technical detail.

Detection Methods for CVE-2025-6122

Indicators of Compromise

HTTP requests to /table.php containing SQL metacharacters in the ID parameter, such as single quotes, --, UNION, or SLEEP(
Unusual database errors logged by the application following requests to /table.php
Spikes in request volume to /table.php from a single source IP address

Detection Strategies

Inspect web server access logs for non-numeric values supplied to the ID parameter of /table.php
Deploy a Web Application Firewall (WAF) rule set with SQL injection signatures targeting query string parameters
Enable database query logging and alert on anomalous query patterns originating from the Restaurant Order System application user

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation
Establish baselines for legitimate ID parameter values, which should be integers, and flag deviations
Monitor outbound database connections for unexpected data exfiltration volumes

How to Mitigate CVE-2025-6122

Immediate Actions Required

Restrict network access to the Restaurant Order System to trusted internal users only
Audit application accounts and disable or rotate credentials for any unused or shared low-privilege accounts
Review web and database logs for prior exploitation attempts referencing /table.php

Patch Information

No official vendor patch has been published in the referenced advisories. Consult the Code Projects Security Hub for any forthcoming updates. Organizations should consider replacing or forking the application to apply input validation directly.

Workarounds

Modify /table.php to use parameterized queries or prepared statements for all database interactions involving the ID parameter
Apply server-side input validation that enforces an integer type and a strict range on the ID value
Deploy a WAF rule that blocks SQL metacharacters in the ID query parameter for requests to /table.php
Run the database account used by the application with the minimum privileges required, removing DROP, ALTER, and FILE permissions

bash

# Example WAF rule (ModSecurity) to block SQLi in the ID parameter
SecRule ARGS:ID "@detectSQLi" \
    "id:1006122,phase:2,deny,status:403,\
    msg:'CVE-2025-6122 SQL Injection attempt in /table.php ID parameter',\
    tag:'CWE-89'"