CVE-2025-12315 is a Medium severity (CVSS 4.7) SQL injection flaw in code-projects Food Ordering System 1.0. The itemPrice parameter in /admin/menu.php is passed to the database unsafely. No fixed version is confirmed in the record, so treat the application as vulnerable until the vendor or your own code review says otherwise.
What's affected
The NVD record names code-projects Food Ordering System 1.0. The weak spot is the admin menu page at /admin/menu.php, where the itemPrice parameter ends up inside a database query. The record says the attack can be started remotely and that a public report exists, so the problem is documented outside the vendor.
Weakness classes: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component (injection)), CWE-89 (SQL Injection).
No fixed release is named in the record or in the references listed with it. Do not assume a patch exists. If the project publishes one later, its own release notes are the place to confirm the version.
How to check if you're exposed
This is a small PHP application that is usually deployed by copying files to a web server, so there is no package manager to query. Check these things on each host that might run it:
- Search the web root for the file named above, for example with
find /var/www -name "menu.phpp", adjusting the path for your server. A match means the code is present. - Check the application title or readme for the version string. The record covers version 1.0.
- Look at your web server access log for requests to that file with unusually long or odd values in the itemPrice parameter, and at the database log for query errors around the same times.
- Ask whether the page is reachable from the internet or only from an internal network. The score vector says the attacker needs a high-privilege (administrator-level) account, so this one is scored lower than a bug anyone on the internet can reach.
If you are not sure whether anyone in your company ever installed it, search your code repositories and hosting accounts for the product name. Sample and tutorial apps like this often end up on a demo server and stay there.
What to do now
- Take the application off the public internet, or put it behind a VPN or an access-controlled reverse proxy, until it is fixed.
- Check the vendor site and the project issue tracker for a patched release. If none exists, plan to fix the code yourself or replace the application.
- In the code, replace string-built queries that touch the itemPrice value with prepared statements and bound parameters, and validate the value against the type you expect.
- Run the database account for this app with only the permissions it needs, and keep it separate from any other application data.
- Review the logs mentioned above for the period since the app went online, and rotate any passwords stored in its database if you see signs of misuse.
Why it matters
SQL injection happens when user input is joined into a query string instead of being passed as a bound value. The database cannot tell which part is the developer's query and which part is the visitor's text, so the input can change what the query does. It is one of the oldest and best understood bug classes, and the fix is routine: parameterized queries.
Small PHP apps of this kind tend to repeat the pattern across many pages, so one report is often a sign of more. If you run Food Ordering System, assume the rest of the code deserves the same review. The record says the exploit has been made public, and it does not report exploitation in the wild; this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a patch for CVE-2025-12315?
None is confirmed in the record or its references. Check the vendor site and the project issue tracker, and treat the app as vulnerable until you can confirm a fix.
Is this being exploited in the wild?
The record does not say so and the CVE is not in the CISA KEV catalog. A public report exists, which makes copycat attempts more likely.
Sources
- Safeguard Gold entry for CVE-2025-12315
- NVD record for CVE-2025-12315 (published 27 October 2025), the basis for the scores, weakness classes and affected product data above
References listed in the NVD record (third-party reports and the vendor home page; no vendor advisory with a fixed version was confirmed):
- https://code-projects.org/
- https://github.com/kaka00666/food-ordering-cve/issues/2
- https://vuldb.com/?ctiid.329987
- https://vuldb.com/?id.329987
- https://vuldb.com/?submit.677036
Last reviewed: 19 October 2026.
