A vulnerability exists in the deleteproduct.php page of itsourcecode's Online Cake Ordering System, where an attacker can manipulate an ID argument to inject arbitrary SQL statements. This flaw allows a remote adversary to read, modify, or delete database records, potentially leading to unauthorized data exposure or loss of integrity. The weakness relies on improper handling of user supplied input and the absence of prepared statements, corresponding to CWE-74 and CWE-89.

The affected system is itsourcecode's Online Cake Ordering System, specifically version 1.0. No other versions are listed in the CNA data.

The CVSS score of 5.3 indicates a medium severity vulnerability, and while EPSS data is not available, the exploit is publicly available and can be launched remotely. The absence of a KEV listing suggests it has not yet been widely leveraged, but the combination of remote access and database compromise potential yields a moderate risk profile for affected deployments.