A flaw in the deletecustomer.php component of the itsourcecode Online Cake Ordering System allows an attacker to manipulate the ID argument so that arbitrary SQL code is executed by the underlying database. This vulnerability is a classic SQL injection (CWE-74 and CWE-89) that can be exploited remotely from any network location. If successful, an attacker could read, modify, or delete customer records, thereby compromising the confidentiality, integrity, and availability of the data stored by the application.

The affected product is the itsourcecode Online Cake Ordering System version 1.0. The vulnerability specifically impacts the deletecustomer.php script used for removing customer records. No other products, versions, or components are listed in the supplied data as affected.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low overall exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The CVE description confirms that an exploit has already been published and that the attack vector is remote, meaning the threat persists until appropriate mitigations are applied.