Cake Ordering System CVE-2026-108959

Requires a valid authenticated low-privilege session on the Online Cake Ordering System (CVSS PR:L) to reach the /addtransacdetail.php endpoint; the attacker then supplies a malicious value in the ID parameter, which is interpolated into a SQL query without sanitization. No special non-default configuration is indicated and no user interaction is needed (UI:N). The principal limiting factors are the authentication requirement and the near-zero real-world deployment of this sample application; exploitation is network-reachable but gated behind having (or registering) an account.

This is a high-volume, low-severity finding that should sit near the bottom of any patch queue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity SQL injection, but it requires an existing authenticated session (PR:L) and the vendor-assigned base score is only 2.1, with all impacts rated Low (VC:L/VI:L/VA:L) and no scope change. A public proof-of-concept exists (GitHub issue linked via VulDB, exploit maturity E:P/Proof-of-Concept in the vector), which modestly raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of real-world or widespread exploitation. The dominant risk-limiting factor is the product itself: itsourcecode 'Online Cake Ordering System' is a tutorial/sample PHP application with negligible production deployment, so even a trivially exploitable SQLi carries little aggregate real-world risk. Net: a real but very low priority - a textbook CWE-89 in an obscure app, not an urgent threat. Note one mild tension: the POC maturity signal implies working exploit code, yet the extremely low CVSS and absence of KEV/EPSS indicate this is opportunistic/hobbyist disclosure rather than a targeted or widespread campaign.

An authenticated low-privilege user of the Online Cake Ordering System sends a crafted value in the ID parameter to /addtransacdetail.php, injecting SQL that the application concatenates into a query. This lets the attacker read or tamper with database contents (e.g., order, transaction, or account records). A public proof-of-concept exists, lowering the skill barrier, though exploitation still requires a valid session.