Cake Ordering System CVE-2026-114381

Exploitation requires network access to a deployed Online Cake Ordering System 1.0 instance and, per the CVSS vector (PR:L), a low-privilege authenticated session to reach /orderdetail.php; the attacker then manipulates the ID parameter to inject SQL. Limiting factors: the required authentication (PR:L) means this is not an unauthenticated drive-by, impact is only partial (VC:L/VI:L/VA:L) rather than full database takeover, and the product is a rarely-deployed open-source PHP application, so realistic exposure is minimal. No non-default configuration is called out in the description.

This is a classic high-volume, low-real-priority disclosure. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a Medium 5.3 score, reflecting a network-reachable SQL injection that nonetheless requires at least low-level authentication (PR:L) and delivers only partial (Low) confidentiality, integrity, and availability impact rather than full database compromise. The E:P (Proof-of-Concept) temporal signal aligns with the reported public exploit on GitHub, but POC availability is NOT active exploitation. No CISA KEV listing and no EPSS score were provided, so there is no evidence of widespread or targeted in-the-wild use. SSVC-style framing: exploitation is proof-of-concept (not active), the flaw is likely automatable (SQLi via a single ID parameter), but technical impact is partial and the product footprint is negligible. The only intelligence source is VulDB (a single researcher submission), which lowers confidence further. Net: a real but low-priority vulnerability in an obscure product - not a fire-drill despite the public POC.

A low-privileged authenticated user (or any account on an open-registration instance) sends a crafted value in the ID parameter to /orderdetail.php, injecting SQL that the backend executes against the order database. A proof-of-concept exploit is publicly posted on GitHub, so the injection point and payload are already documented; because attack complexity is low, extracting or tampering with order records requires little skill.