CVE-2025-11604: projectworlds Online Ordering Food System all-orders.php sql injection

Published Oct 11, 2025

Updated

A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected Software

2 affected components

Projectworlds Online Ordering Food System

Projectworlds Online Food Ordering System=1.0

Event History

Oct 11, 2025

CVE Published

via MITRE·02:02 PM

Data Sourced

via MITRE·02:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11604?

CVE-2025-11604 is considered a high severity vulnerability due to its SQL injection potential.

How do I fix CVE-2025-11604?

To fix CVE-2025-11604, validate and sanitize inputs to the /all-orders.php file to prevent SQL injection.

What are the risks of CVE-2025-11604?

The risks of CVE-2025-11604 include unauthorized access to sensitive data and potential data manipulation.

Who is affected by CVE-2025-11604?

Users of Projectworlds Online Ordering Food System version 1.0 are affected by CVE-2025-11604.

Can CVE-2025-11604 be exploited remotely?

Yes, CVE-2025-11604 can be exploited remotely, making it critical to address immediately.