Affected function in orderdetail.php permits an attacker to supply a crafted ID parameter that is directly concatenated into an SQL query, resulting in a classic SQL injection flaw. This can allow an attacker to retrieve, modify, or delete data within the underlying database without authentication, potentially exposing sensitive customer information or compromising order integrity. The root weakness aligns with CWE-89 and improper neutralization of input (CWE-74).

The vulnerability exists in itsourcecode's Online Cake Ordering System, specifically in version 1.0 of the application. Users running this version are exposed, as the flaw occurs in an unspecified function within the orderdetail.php page. No other versions or components were identified as affected in the available data.

With a CVSS score of 5.3, the flaw presents a moderate threat level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation yet. However, the description confirms that the attack can be performed remotely and that the exploit has already been disclosed. Attackers may target the exposed ID parameter from external networks to manipulate database contents or extract private data.