CVE-2025-8236 rates 7.3 (high) and covers SQL injection in code-projects Online Ordering System 1.0. The vulnerable file is /admin/edit_product.php, and the Name parameter is the entry point. A public exploit exists and the record names no fixed version, so restrict access and parameterize the query.
What's affected
code-projects Online Ordering System version 1.0 is the version named in the record. The vulnerable file is /admin/edit_product.php and the argument is Name. The reporter says the Name value arrives in a POST request.
The reporter states that no login or authorization is needed to reach it, so treat that as the working assumption until you test your own copy.
The record gives a CVSS 3.1 score of 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The record's own wording calls the issue critical, which is the language VulDB uses for the report, while the numeric score places it in the high band. Both are shown here so you can decide which to weigh.
No fixed version is listed. code-projects Online Ordering System is a small PHP project of the kind distributed as sample or learning code, and the sources I read show no vendor patch. Check the project page or your own source drop for any newer release before assuming none exists.
How to check if you're exposed
First find out whether you run it. Search your web roots for the vulnerable file name. Adjust the path to your server layout.
find /var/www -name "edit_product.php" 2>/dev/null
If the file exists, open it and look at how the Name value is used. A query built by joining text and the variable, rather than a prepared statement, matches the reported pattern.
Next, see who has been calling it. Your web server access log shows requests to the path.
grep "edit_product.php" /var/log/apache2/access.log | tail -n 50
Look for unusual values in the Name field, long strings, quote characters or SQL keywords, and for requests from addresses you do not recognize. Only test copies you own.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan on the project's manifests. It covers third-party packages, so it will not find a flaw in the application's own code, but it will show what else in the project is out of date.
What to do now
- Find every copy of code-projects Online Ordering System in your environment, including test and demo installs.
- Take public-facing copies offline, or put them behind a VPN or an allowlist of trusted addresses.
- Rewrite the query in
edit_product.phpto use prepared statements with bound parameters, and validate the type ofName. - Run the database account with the least privilege the page needs. A page that only reads should not hold write or admin rights.
- Review access logs and the database for unexpected changes, and rotate any credentials stored in the database if you see signs of misuse.
- If the app is a sample or training project, remove it from any server that holds real data.
Why it matters
The class is CWE-89 (SQL Injection), within CWE-74 (Injection). Code that concatenates a request value into SQL gives the caller a way to alter the query. Depending on database permissions, that can mean reading, changing or deleting records that the page was never meant to touch.
The record does not flag this CVE as CISA KEV, and it makes no claim about attacks seen in the wild. It does say a public exploit has been disclosed, which lowers the effort for anyone who finds the app exposed. Software like this tends to show up on small business servers and in student projects that were never meant for production, which is exactly why an inventory matters.
Quick check
Where is the fix for CVE-2025-8236?
The record lists no fixed version for code-projects Online Ordering System 1.0. Neither the NVD record nor the reporter page names a patch, so the practical fix is to change the code to use prepared statements, or to stop running the application.
Is hiding the admin folder enough?
No. Renaming or hiding a path does not change the code behind it. Restrict access by network or authentication and fix the query as well.
Sources
- CVE-2025-8236 on Safeguard Gold
- https://github.com/xiajian-qx/cve-xiajian/issues/3
- NVD record data for CVE-2025-8236, published 2025-07-27
Last reviewed: 18 October 2026.
