CVE-2025-3333 is a High (CVSS 7.3) SQL injection in code-projects Online Restaurant Management System 1.0. The menu argument in /admin/menu_update.php reaches a database query unsafely. No fixed version is named in the record, so check the vendor site, and take the app off the public internet until the code is repaired.
What's affected
The record lists one version of one product: code-projects Online Restaurant Management System 1.0. The vulnerable file is /admin/menu_update.php, and the argument named in the record is menu. The description adds that other parameters might be affected as well in some of these reports, so do not limit a review to the single field named.
The description says the attack can be started remotely and that an exploit has been disclosed to the public and may be used. That wording comes from the VulDB style record. It does not mean the CVE appears in the CISA Known Exploited Vulnerabilities list. The KEV flag for this record is false.
No patched release is named in the record. The vendor site (code-projects) is the place to look for any update. If you cannot confirm a fix there, assume there is none and fix the code yourself or retire the application.
This is one of a run of reports against the same application, each in a different script. The record's reference list points to a numbered issue on the reporter's public CVE repository for this one. Fixing a single file will not make the application safe, so audit every script that touches the database.
How to check if you're exposed
You are exposed if you deployed this application, or a copy of its source, anywhere that accepts network connections.
- Search your web roots and repositories for the file name, for example
find . -name "menu_update.php"on the server, and compare its location with/admin/menu_update.php. - Open the file and look at how the
menuvalue is used. If it is placed into an SQL string by concatenation instead of a prepared statement, the issue is present in your copy. - Search the whole project for the same pattern, for example
grep -rn "mysqli_query\|mysql_query" ., and read each hit. Sibling scripts often share the flaw. - Check web server access logs for requests to
/admin/menu_update.phpwith unusual values inmenu, and for database errors in the application log. - Run the free in-browser dependency scan on any manifest you have. Note that a scan of dependencies will not find a flaw in first party PHP code, so the code review above still matters.
What to do now
- Remove the application from public access, or put it behind a VPN, an IP allowlist or HTTP authentication, until the code is fixed.
- Replace string built SQL in
/admin/menu_update.phpwith prepared statements and bound parameters. Validate types, so an ID is accepted only as a number. - Apply the same change to every other script that queries the database.
- Make sure the database account the app uses has only the privileges it needs. It should not own the schema or reach other databases.
- Review the database for unexpected rows or new accounts, and rotate any credentials stored in it if you suspect misuse.
- Check the vendor site for an update and note the date you checked.
Why it matters
The weakness is CWE-89, improper neutralization of special elements used in an SQL command, filed under the parent class CWE-74, injection. The program mixes data and code in a single string. When a value that came from the user is pasted into a query, the database cannot tell where the intended command ends and the input begins.
The record's vector shows no privileges required, so an unauthenticated visitor could reach the flaw. The file sits under the admin area, which usually sits behind a login, but the vector still lists no privileges required, so do not assume that folder is protected. With a low bar to reach it, a public disclosure and no named fix, a deployed copy deserves attention even though the severity is High rather than Critical. For a small business app the data at stake is often real: customer details, orders, staff accounts.
Quick check
Is there a patched version?
The record does not name one. Check the vendor site and the project page, and if nothing is confirmed, fix the query code yourself or take the app offline.
Will a dependency scanner find this?
Not by itself. This is a flaw in the application's own PHP code, not in a third party package. Code review or static analysis of the source is the right check. A dependency scan still helps for the libraries the app pulls in.
Sources
- Gold vulnerability page for CVE-2025-3333
- The reference list in the NVD record, which points to a public report from the researcher and to a VulDB entry. Some of those pages were not reachable when reviewed, so verify against the vendor before relying on them.
Last reviewed: 18 October 2026.
