Online Cake Ordering System EUVD-2026-104090

Exploitation targets the 'cancel' argument processed by confirm.php in itsourcecode Online Cake Ordering System 1.0. The CVSS vector's PR:L indicates a valid low-privileged authenticated session (e.g., a registered customer account) is required before reaching the vulnerable confirmation/cancellation flow; no user interaction (UI:N) is needed. The primary limiting factors are the authentication requirement and the vendor-rated low impact (VC:L/VI:L/VA:L), plus the effectively nonexistent production footprint of this tutorial application, which sharply constrains realistic real-world risk despite the network attack vector.

This is a low-priority vulnerability despite being a network-reachable SQL injection (CWE-89). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores only 2.1, reflecting that exploitation requires low-level authentication (PR:L) and yields only limited confidentiality, integrity, and availability impact with no subsequent-system impact (SC:N/SI:N/SA:N). The vendor-assigned impact (VC:L/VI:L/VA:L) is unusually conservative for a SQL injection, which can often enable full database disclosure - this is a notable tension worth verifying against the actual exploit. The exploit maturity is marked E:P (proof-of-concept), consistent with the publicly available POC. No EPSS score was provided in the input, and there is no CISA KEV listing, so there is no evidence of active exploitation - only publicly available exploit code. The disclosure originates solely from VulDB, a crowd-sourced vulnerability database, with no independent vendor advisory; itsourcecode is a source-code tutorial project, so real-world production exposure is minimal. Net assessment: a genuine but very low-impact issue, far more relevant as hygiene than as an urgent threat.

A low-privileged authenticated user of the Online Cake Ordering System sends a crafted value in the 'cancel' parameter to confirm.php, injecting SQL that manipulates the backend query to read or alter order data. A public proof-of-concept exploit exists (referenced via a GitHub issue), lowering the skill barrier, though the CVSS vector indicates only limited impact to confidentiality, integrity, and availability.