CVE-2025-14250CWE-74CWE-89sql-injection

CVE-2025-14250

High · published December 8, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
31.6
In the wild
Unconfirmed
What it is

⚠️ A sneaky SQL injection vulnerability lurks in the Online Ordering System 1.0, where an attacker can manipulate user contact info to target your database! 🔍 Think of it like a restaurant where someone can secretly change your order by whispering a different name to the server—what you receive could be completely unexpected! 🍽️ If exploited, an attacker could gain unauthorized access to your database, potentially stealing or altering sensitive information without a trace. While it's a medium threat, it could lead to disastrous results if sensitive data falls into the wrong hands!

Put simply

Think of it like a restaurant where someone can secretly change your order by whispering a different name to the server—what you receive could be completely unexpected! 🍽️ This vulnerability exists in the argument manipulation in /user_contact.php, enabling SQL injection that permits attackers to execute arbitrary SQL commands remotely.

What to do

If exploited, an attacker could gain unauthorized access to your database, potentially stealing or altering sensitive information without a trace. While it's a medium threat, it could lead to disastrous results if sensitive data falls into the wrong hands! To protect your system, ensure you're sanitizing user inputs and employing prepared statements in your database queries. Patch your system if an update is available, and consider auditing your code for any similar vulnerabilities! You've got this! By taking these steps, you'll turn this vulnerability into a thing of the past. 🦸‍♂️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00387 · 31.6th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-08T21:15Z
Affected products (1)
ProductVersionsFixed in
fabian/online_ordering_systemall versions—
References (6)
EPSS history
Timeline
  • 08 DEC 15:32Z
    code-projects Online Ordering System user_contact.php sql injection
    cvelistv5