CVE-2025-6123: High SQL Injection in Restaurant Order System

CVE-2025-6123 is a high (CVSS 7.3) SQL injection flaw in code-projects Restaurant Order System 1.0. The record says /payment.php passes the tabidNoti argument into a database query unsafely, and a public exploit has been disclosed. Fix status: no fixed version is named.

What's affected

• Product: code-projects Restaurant Order System 1.0.
• Affected version: 1.0.
• Vulnerable file and argument: /payment.php, parameter tabidNoti.
• Weaknesses: CWE-89 (SQL injection) and CWE-74 (injection).
• Fixed version: None is named in the CVE record. Check the vendor or project page for any update before relying on this.
• Access needed: no login required. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
• Public exploit: the record says the exploit has been disclosed to the public and may be used.
• Known exploited: no, the record is not flagged by CISA KEV.

The score for this entry is 7.3 (High). Read the description carefully for the vendor wording, because some of these projects have no maintained release channel.

How to check if you're exposed

First confirm whether you run this software at all. Look at your application inventory, web roots, container images and any package lists for code-projects Restaurant Order System 1.0. If you cannot find it, make sure no team has deployed it as a side project, because tools of this kind are often installed once and forgotten.

Then confirm the version. The record names 1.0 as affected.

# find the vulnerable file in your deployment
find /var/www -name "payment.php" 2>/dev/null

# review how it builds its query (look for string concatenation with request values)
grep -n "tabidNoti" payment.php | head
grep -n "mysqli_query\|->query(\|mysql_query" payment.php | head

Replace /var/www with your web root. If you see request values joined into a query string, you have the weakness the record describes.

Look for the path /payment.php in web server logs. Requests to it carrying quote characters, comment markers or SQL keywords in the tabidNoti value are worth a closer look. A clean log does not prove you are safe, but unusual hits tell you to treat the system as compromised and rotate any credentials the database holds.

What to do now

1. Find every deployment of code-projects Restaurant Order System 1.0 and note the version.
2. Check the vendor or project page and the references in the CVE record for a patch. The record names none, so do not assume one exists.
3. If you cannot patch, remove the application from the internet or put it behind a VPN or an authenticating reverse proxy.
4. Add a web application firewall rule for SQL injection patterns on /payment.php as a stopgap. It reduces risk but is not a fix.
5. If you maintain the code, change the query to use prepared statements with bound parameters, and validate the tabidNoti value.
6. Make sure the application connects to the database with an account that has only the permissions it needs, and rotate the credentials if you suspect misuse.
7. Rescan the project with the free in-browser dependency scan so the dependency and code findings are tracked in one place.

Why it matters

SQL injection happens when user input is placed into a database query as text instead of as a bound parameter. The database cannot tell the developer's query from the attacker's input, so crafted values can change what the query does. CWE-89 is the specific class, and CWE-74 is the broader injection parent that the record also lists.

The CVSS vector rates impact as low across confidentiality, integrity and availability, which is why the score is not higher. Do not read that as harmless. The real damage depends on what the database holds and which account the application uses to reach it.

If no vendor fix appears, the lasting answer is to replace the software. If code-projects Restaurant Order System 1.0 is running anywhere that handles real data, plan that replacement now. The record does not mark this entry as exploited in the wild. It does say the exploit is public, which lowers the effort for anyone who wants to try it, so expose-and-forget deployments are the ones to fix first.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-6123
• code-projects.org/ (listed in the CVE record, not fetched)
• github.com/ez-lbz/poc/issues/1 (listed in the CVE record, not fetched)
• vuldb.com/?ctiid.312592 (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.