CVE-2025-4490

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /view-ticket-admin.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Online Food Ordering System	1.0

References

https://github.com/wyl091256/CVE/issues/10Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.308205Permissions Required, VDB Entry
https://vuldb.com/?id.308205Third Party Advisory, VDB Entry
https://vuldb.com/?submit.566785Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: May 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-449006.5In Tenda RX3 V1.0br_V16.03.13.11 in the GetParentControlInfo function of the web url /goform/GetParentControlInfo, the manipulation of the p CVE-2025-449048.8hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.CVE-2025-449058.8hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.CVE-2025-449067.8jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.CVE-2025-44919.8A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of th CVE-2025-44929.8A vulnerability, which was classified as critical, has been found in Campcodes Online Food Ordering System 1.0. This issue affects some unkn CVE-2025-44936.5Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorize CVE-2025-44949.8A vulnerability, which was classified as critical, was found in JAdmin-JAVA JAdmin 1.0. Affected is the function toLogin of the file NoNeedL CVE-2025-44955.4A vulnerability has been found in JAdmin-JAVA JAdmin 1.0 and classified as problematic. Affected by this vulnerability is an unknown functio CVE-2025-449517.1A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a loc CVE-2025-449527.8A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and earlier, allows a CVE-2025-449549.8RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.