Online Cake Ordering System
Monthly
SQL injection in itsourcecode Online Cake Ordering System 1.0 lets a low-privilege authenticated remote user manipulate the ID argument of /deletetransac.php to alter database queries, with low confidentiality, integrity, and availability impact. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed. The issue is low-to-moderate and non-urgent, requiring a valid session and affecting a niche application with minimal real-world deployment.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows a low-privileged authenticated remote attacker to manipulate the ID parameter handled by /orderdetail.php and influence backend database queries, with partial confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but no CISA KEV entry or confirmed active exploitation is indicated in the supplied data. The application is a niche open-source PHP product, so realistic exposure is limited to deployed instances reachable by authenticated users.
SQL injection in the /deleteproduct.php endpoint of itsourcecode Online Cake Ordering System 1.0 allows authenticated low-privilege users to manipulate the ID parameter and run arbitrary SQL against the application database. The issue is remotely reachable but requires a valid account (CVSS 5.3, PR:L), and publicly available exploit code exists via a GitHub issue; no CISA KEV active exploitation is confirmed. This is a moderate priority because the niche PHP project is unlikely to be internet-exposed and exploitation is gated by authentication.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows authenticated remote attackers to manipulate the 'cancel' argument in confirm.php, potentially exposing or altering limited data. A public exploit is available, but the vulnerability requires a low-privileged session and has low impact, and the product's negligible production presence keeps real-world risk low.
SQL injection in the itsourcecode Online Cake Ordering System 1.0 lets a remote, authenticated low-privilege user subvert database queries through the ID parameter of /addtransacdetail.php, which the PHP code interpolates into a SQL statement without sanitization, producing low confidentiality, integrity, and availability impact (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the reported E:P metric reflects proof-of-concept maturity, but the CVE is not in CISA KEV, so active exploitation is not confirmed; the principal limiting factors are the low-privilege authentication requirement and the practically non-existent real-world deployment of this sample PHP application.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.
SQL injection in itsourcecode Online Cake Ordering System 1.0 lets a low-privilege authenticated remote user manipulate the ID argument of /deletetransac.php to alter database queries, with low confidentiality, integrity, and availability impact. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed. The issue is low-to-moderate and non-urgent, requiring a valid session and affecting a niche application with minimal real-world deployment.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows a low-privileged authenticated remote attacker to manipulate the ID parameter handled by /orderdetail.php and influence backend database queries, with partial confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but no CISA KEV entry or confirmed active exploitation is indicated in the supplied data. The application is a niche open-source PHP product, so realistic exposure is limited to deployed instances reachable by authenticated users.
SQL injection in the /deleteproduct.php endpoint of itsourcecode Online Cake Ordering System 1.0 allows authenticated low-privilege users to manipulate the ID parameter and run arbitrary SQL against the application database. The issue is remotely reachable but requires a valid account (CVSS 5.3, PR:L), and publicly available exploit code exists via a GitHub issue; no CISA KEV active exploitation is confirmed. This is a moderate priority because the niche PHP project is unlikely to be internet-exposed and exploitation is gated by authentication.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows authenticated remote attackers to manipulate the 'cancel' argument in confirm.php, potentially exposing or altering limited data. A public exploit is available, but the vulnerability requires a low-privileged session and has low impact, and the product's negligible production presence keeps real-world risk low.
SQL injection in the itsourcecode Online Cake Ordering System 1.0 lets a remote, authenticated low-privilege user subvert database queries through the ID parameter of /addtransacdetail.php, which the PHP code interpolates into a SQL statement without sanitization, producing low confidentiality, integrity, and availability impact (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the reported E:P metric reflects proof-of-concept maturity, but the CVE is not in CISA KEV, so active exploitation is not confirmed; the principal limiting factors are the low-privilege authentication requirement and the practically non-existent real-world deployment of this sample PHP application.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.