Technical impact
The vulnerability exists in the inserttrans.php script of the Online Cake Ordering System 1.0. By manipulating the prcd argument, an attacker can inject arbitrary SQL commands. This flaw allows an attacker to read, modify, or delete data stored in the application's database, compromising confidentiality, integrity, and potentially availability of the system. The weakness is characterized by improper input sanitization and direct SQL execution.
Affected Systems
The affected system is the Online Cake Ordering System version 1.0 developed by itsourcecode. The vulnerability is located in the inserttrans.php module, which processes transaction data received from remote clients.
Risk and Exploitability
The CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score is not available, but the exploitation method is remote and has been publicly disclosed, suggesting a non-negligible risk of abuse. The vulnerability is not listed in the CISA KEV catalog, though its public availability increases the likelihood of attacker activity. Attackers can reach the vulnerable endpoint over the internet by sending crafted requests containing malicious prcd values, bypassing standard application safeguards.
