Online Cake Ordering System Injection Flaws

SQL injection in itsourcecode Online Cake Ordering System 1.0 allows an authenticated low-privileged remote user to manipulate the ID argument of /deletecustomer.php and alter database queries. Publicly available exploit code exists, but the application is a niche tutorial-style system rarely deployed in production, so the realistic priority is LOW despite remote reachability. The weakness is limited to low confidentiality, integrity, and availability impact and requires valid credentials before exploitation.

Reflected cross-site scripting in itsourcecode Online Cake Ordering System 1.0 allows unauthenticated remote attackers to execute script in a victim's browser via the useruid parameter on /404.php, provided the victim opens a crafted link. Publicly available exploit code exists, and the CVSS 4.0 score of 2.1 reflects the requirement for user interaction and limited impact; no CISA KEV active exploitation is reported.