Cake Ordering System EUVD-2026-107568

Exploitation requires a low-privileged authenticated session on the application (CVSS PR:L), after which the attacker manipulates the 'prcd' argument submitted to the /inserttrans.php endpoint to perform SQL injection; no user interaction and no non-default configuration is needed. The primary limiting factors are the required authentication level (an account/session is needed, so this is not unauthenticated) and the product's extremely narrow deployment footprint as an itsourcecode tutorial application, both of which sharply constrain realistic impact.

This is a low-priority issue despite being a remotely reachable SQL injection. The CVSS 4.0 base score is only 2.1, consistent with its vector (AV:N/AC:L/PR:L/UI:N) showing network access but requiring low privileges (PR:L, i.e. an authenticated account) and yielding only partial impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L, with no subsequent-system impact SC/SI/SA:N). The exploit maturity metric E:P confirms a proof-of-concept exists, matching the description's statement that the exploit has been made public. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation - publicly available exploit code exists, but POC availability is a distinct signal from in-the-wild use and must not be conflated. The signals are internally consistent (low-privilege, low-impact, PoC-only), pointing to a genuine but low-severity flaw rather than a widely-weaponized threat. The dominant risk-reducing factor is the product itself: itsourcecode Online Cake Ordering System is a small tutorial/learning PHP application with negligible production deployment, which drives real-world risk far below what even the modest CVSS score might suggest.

An attacker who holds a low-privileged account on an exposed Online Cake Ordering System instance sends a crafted value in the 'prcd' parameter to /inserttrans.php, injecting SQL that the backend executes against the database. Because a public proof-of-concept exists (referenced via the GitHub issue and VulDB entry), the attacker can reproduce the injection to read or tamper with limited database contents. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates this is achievable remotely with low attack complexity once authenticated.