A critical SQL injection vulnerability in the Simple Pizza Ordering System version 1.0 allows for remote, unauthenticated database manipulation.

The application is susceptible to SQL injection via the ID parameter in the listorder.php script. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Successful exploitation of this vulnerability permits unauthorized access to the application database, potentially leading to the exposure, modification, or deletion of sensitive ordering data. Given the CVSS score of 7.3, this represents a high risk to data integrity and confidentiality. Organizations relying on this software may face significant operational disruption and loss of customer trust if the database is compromised.

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict network access to the affected system or disable the listorder.php functionality if it is not business critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting listorder.php, specifically looking for SQL syntax patterns or unusual character sequences in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate the risk until a permanent software fix is applied.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub repository.

This vulnerability presents a high risk due to the availability of proof-of-concept code and the lack of a vendor-provided security update. Administrators must treat this as a priority and implement compensating controls or network isolation immediately to prevent unauthorized database access. Continued vigilance and migration to a supported, secure alternative are strongly advised.