This vulnerability allows an attacker to manipulate the ID parameter in the addtransacdetail.php file of the Online Cake Ordering System 1.0, resulting in a classic SQL injection. The flaw is caused by improper handling of user input, allowing an attacker to inject arbitrary SQL commands. The weakness corresponds to CWE-74, indicating a malformed input that is treated as SQL code, and CWE-89, a generalized SQL injection entry. As a result, an attacker who can supply a crafted ID value could read or modify database records, potentially exposing sensitive customer data and transaction details.

The issue is detected in itsourcecode Online Cake Ordering System version 1.0, affecting the addtransacdetail.php component. No other products or versions are listed as impacted in this entry.

The CVSS score of 5.3 classifies the flaw as medium severity. The exploit is feasible from a remote location, and it has already been disclosed publicly, indicating that attackers could target exposed installations. The EPSS score is not provided, but the lack of a KEV listing does not mitigate the risk, as the vulnerability is actively known. Attacks would typically involve sending a malicious ID via HTTP requests that the application then inserts unsafely into a SQL query, allowing data exfiltration or modification.