CVE-2025-5980: High SQL Injection in Restaurant Order System

CVE-2025-5980 is a high severity (CVSS 7.3) SQL injection in code-projects Restaurant Order System 1.0. The tabidNoti argument of /order.php is affected. The record lists no fixed version, so restrict access to the application or retire it. The sections below cover who is affected, how to check, and what to do now.

What's affected

code-projects Restaurant Order System version 1.0 is named in the record. The record does not list a fixed version, and I could not find a vendor patch or release note to point to. Treat every installation of this application as affected until the project says otherwise.

The affected file is /order.php and the affected argument is tabidNoti.

How to check if you're exposed

Check whether the application is installed anywhere you run or host it. These small PHP projects are often downloaded as source and deployed by hand, so they may not appear in any package manager.

grep -ril "restaurant order" /var/www 2>/dev/null | head

Then review your web server access logs for requests to the affected path, /order.php, from addresses you do not recognise. The record states that the exploit has been disclosed to the public, so assume the path is known to scanners.

What to do now

1. Decide whether you need this application at all. It is a sample style project, and the simplest fix for an unmaintained app is to retire it.
2. If it must stay, remove it from the public internet. Put it behind a VPN, an allow list or at minimum HTTP authentication at the web server.
3. Check the vendor site and the linked issue for a patched release, and apply it if one exists. Do not assume one does.
4. Fix the code path yourself if you maintain a fork, following the defence described below.
5. Review logs and the database for activity you cannot explain, and rotate any credentials stored by the application.

Why it matters

The record maps this to CWE-89 (SQL injection) and CWE-74 (injection). The tabidNoti value, which looks like a table identifier for an order notification, reaches a query unsafely. The scoring is network reachable, low complexity, no privileges, and low impact in all three areas.

The record says the exploit has been disclosed publicly. It is not on the CISA KEV list. For a small business running this app, the real risk is the order and customer data in its database, so check what that database holds and which account the application connects with.

SQL injection happens when input reaches a database query as part of its structure instead of as plain data. The reliable defence is the same everywhere: parameterised queries or prepared statements, and no string building for anything a user can influence. Input validation helps, but it is a second line, not the first.

If you find injectable code in your own applications, treat the fix as two jobs. Change the query so the value is bound as a parameter, and check the database account the application uses. An account that can only read the tables it needs turns a bad bug into a smaller one.

Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record data for CVE-2025-5980
• Public issue report
• VulDB entry

Last reviewed: 18 October 2026.