Online Cake Ordering CVE-2026-113740

Exploitation requires an authenticated low-privileged session (CVSS PR:L) with access to the /deletecustomer.php endpoint of a running itsourcecode Online Cake Ordering System 1.0 instance; the attacker manipulates the ID argument, which is passed unsanitized into a SQL query. No user interaction (UI:N) and no special attack requirements (AT:N) are needed beyond that privileged access. Realistic exploitation is sharply limited by the need for valid credentials and by the product's status as a niche tutorial application that is rarely deployed in production environments.

Signals are consistent and point to a genuinely LOW real-world priority despite being a remotely exploitable SQL injection. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores only 2.1, reflecting that all impacts are rated Low and that exploitation requires existing low-level privileges (PR:L) - i.e. an authenticated user, not an anonymous internet attacker. The E:P (Proof-of-Concept) code-maturity value aligns with the reference set, where a public GitHub issue and VulDB entry indicate publicly available exploit code exists, but this is distinct from active exploitation: there is no CISA KEV listing and no EPSS score provided, so there is no evidence of in-the-wild use. No SSVC decision data was supplied. The dominant risk-limiting factor is the product itself: itsourcecode 'Online Cake Ordering System' is a free PHP tutorial/learning project, not enterprise software, so real-world exposure is minimal. Net: a real but low-severity authenticated SQLi in an obscure product - not an urgent priority.

An attacker who already holds a low-privileged account (or access to an authenticated session) on a deployed Online Cake Ordering System submits a crafted value in the ID parameter of /deletecustomer.php, injecting SQL that the backend executes against the database. Public exploit code exists, lowering the skill barrier, allowing the attacker to read or tamper with limited database contents. Because privileges are required (PR:L), it is not an unauthenticated drive-by attack.