PT-2025-49563 · Code Projects · Online Ordering System

Zzb1 · Published 2025-12-08 · Updated 2025-12-09 · CVE-2025-14251

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Online Ordering System version 1.0

Description A security issue exists in code-projects Online Ordering System 1.0. The vulnerability involves the manipulation of the Username argument, leading to SQL injection. This affects an unknown function within the /admin/ file of the Admin Login component. The attack can be launched remotely, and details about the exploit have been publicly disclosed.

Recommendations Apply any available updates to address the SQL injection issue in the Admin Login component. As a temporary workaround, restrict access to the /admin/ file to minimize the risk of exploitation. Sanitize the Username input to prevent SQL injection attacks.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14251

Affected Products

Online Ordering System

References · 10

• 🔥 https://github.com/zzb1388/cve/issues/95 · Exploit
• https://osv.dev/vulnerability/CVE-2025-14251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14251 · Security Note
• https://t.me/CVEtracker/39128 · Telegram Post
• https://t.me/cveNotify/145240 · Telegram Post
• https://vuldb.com/?id.334761 · Note
• https://vuldb.com/?submit.702467 · Note
• https://vuldb.com/?ctiid.334761 · Note
• https://twitter.com/CVEnew/status/1998073124491796560 · Twitter Post
• https://code-projects.org · Note