CVE-2025-13290: code-projects Simple Food Ordering System saveorder.php sql injection

Published Nov 17, 2025

Updated

A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected Software

2 affected components

Code-projects Simple Food Ordering System

Fabian Simple Food Ordering System=1.0

Event History

Nov 17, 2025

CVE Published

via MITRE·04:32 PM

Data Sourced

via MITRE·04:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Sep 1, 58718

Event

via NVD·07:32 AM

Frequently Asked Questions

What is the severity of CVE-2025-13290?

CVE-2025-13290 is classified as a high severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2025-13290?

To fix CVE-2025-13290, sanitize and parameterize all SQL queries that access user-supplied input in the /saveorder.php file.

What type of attack is possible with CVE-2025-13290?

CVE-2025-13290 allows for remote SQL injection attacks due to inadequate input validation.

Which system is affected by CVE-2025-13290?

CVE-2025-13290 affects the Simple Food Ordering System 1.0 from code-projects.

Can CVE-2025-13290 be exploited remotely?

Yes, CVE-2025-13290 can be exploited remotely through manipulation of the argument ID.