TOKO-ONLINE-ROTI CVE-2026-15490

Q: What is the CVSS score of CVE-2026-15490?

CVE-2026-15490 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-43212 MEDIUM

SQL Injection (CWE-89)

2026-07-12 VulDB

GHSA-6vv6-r32c-gp39

PHP SQLi Toko Online Roti Rafymrx

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated network-accessible endpoint with no complexity requirements; limited database read/write impact only, no scope change to other systems.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 12, 2026 - 10:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 12, 2026 - 10:15 vuln.today

DescriptionCVE.org

A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in RafyMrX TOKO-ONLINE-ROTI (up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99) allows remote unauthenticated attackers to manipulate database queries via the kode_produk and kd_cs parameters in proses/add.php. The CVSS 4.0 vector confirms no privileges or user interaction are required, and a public exploit (E:P) has been released, lowering the skill threshold for opportunistic attacks. The vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.

Technical ContextAI

TOKO-ONLINE-ROTI is a PHP-based online bread/bakery shop e-commerce application developed by RafyMrX (CPE: cpe:2.3:a:rafymrx:toko-online-roti:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), meaning user-supplied values for the kode_produk (product code) and kd_cs (customer code) parameters in proses/add.php are concatenated directly into SQL query strings rather than being handled via parameterized queries or prepared statements. This is a classic PHP dynamic query construction defect, common in legacy or hobby-grade PHP applications that do not use PDO or mysqli with bound parameters. The product operates on a rolling-release model with no discrete versioned releases, making patch tracking impractical.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and no fixed commit or release has been confirmed. Operators should immediately restrict public access to proses/add.php via web server ACLs in Apache (Require ip directives) or nginx (allow/deny blocks), blocking access from untrusted sources; this prevents exploitation at the network layer but may break legitimate application functionality if the endpoint is required. As a code-level mitigation, developers familiar with the codebase should refactor the SQL queries in proses/add.php to use PHP PDO prepared statements with bound parameters for kode_produk and kd_cs, eliminating the injection surface entirely; this is the only durable fix. A WAF rule blocking SQL metacharacters (single quotes, UNION, SELECT keywords) in those parameter names can reduce opportunistic attack surface but is subject to encoding-bypass techniques and should not be treated as a substitute for parameterized queries. Database account privilege reduction (restricting the application's DB user to minimum required permissions) limits the blast radius of successful injection. Monitor database and web server logs for anomalous UNION SELECT or stacked query patterns against the add.php endpoint. Reference: https://vuldb.com/cve/CVE-2026-15490.