The vulnerability is an SQL injection flaw triggered by manipulating the cancel argument in confirm.php of itsourcecode Online Cake Ordering System. This flaw, classified as CWE-74 and CWE-89, allows an attacker to inject arbitrary SQL statements, which could lead to data disclosure, alteration, or deletion if exploited successfully.

Affected product is itsourcecode Online Cake Ordering System, currently released as version 1.0. The flaw resides in the confirm.php component that processes unknown or improperly sanitized inputs. Users running version 1.0 without an update are susceptible to this attack vector.

The CVSS score of 5.3 indicates moderate severity, and the lack of an EPSS rating means historical exploitation probability data is not available. The issue is not listed in CISA KEV. The attack can be launched remotely via an HTTP request to confirm.php and a publicly available exploit script exists, suggesting attackers could readily abuse the flaw if they can reach the vulnerable endpoint. Because the vulnerability permits direct manipulation of SQL commands, the potential impact on confidentiality, integrity, and availability is significant, especially if the database contains sensitive customer orders or payment information.