EUVD-2026-43211
GHSA-5vw8-8m33-qq8m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated login form with no prerequisites; availability impact omitted as SQLi at login does not plausibly disrupt service.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in TOKO-ONLINE-ROTI's login endpoint exposes all deployments up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 to unauthenticated remote database manipulation via the Username parameter in proses/login.php. A public exploit is available (CVSS 4.0 E:P), and the vendor has not responded to responsible disclosure, meaning no vendor-released patch exists and no remediation guidance has been issued. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV), but the combination of a fully unauthenticated attack path, low complexity, and available proof-of-concept code elevates real-world risk above the 5.5 base score suggests.
Technical ContextAI
TOKO-ONLINE-ROTI is a PHP-based online bakery shop application hosted on a rolling-release GitHub repository by RafyMrX. The vulnerability resides in proses/login.php, a server-side PHP script that processes login form submissions. CWE-74 (Injection) covers cases where user-supplied input is incorporated into a command or query without adequate neutralization; in this instance, the Username field value is concatenated directly into a SQL query rather than passed through parameterized statements or prepared queries. This is a classic first-order SQL injection at an authentication boundary, a pattern that historically enables both authentication bypass (e.g., ' OR '1'='1) and data extraction via UNION- or error-based techniques, depending on database configuration and error verbosity. The PHP/MySQL stack implied by the tags and file structure is common to small self-hosted web applications, where input validation is frequently absent in authentication routines.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor has not responded to disclosure, making an official fix unlikely in the near term. The root fix requires replacing direct string concatenation of the Username parameter in proses/login.php with parameterized queries or PHP PDO prepared statements, which eliminates the injection surface without functional side effects. As an immediate compensating control, operators should deploy a web application firewall rule targeting common SQL injection patterns (OR-based, UNION-based, comment sequences) on the login endpoint - note that WAF rules are bypassable and do not constitute a permanent fix. If the application handles sensitive customer or payment data, taking it offline or restricting access to trusted IP ranges via server-level ACLs is strongly recommended until a code-level fix is applied. Input validation at the application layer (e.g., rejecting Username values containing SQL metacharacters) can reduce attack surface but is not a substitute for parameterized queries. Advisory references: https://vuldb.com/vuln/377796.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today