The vulnerability is an uncontrolled SQL injection in the transactionsave.php file of itsourcecode Online Cake Ordering System. By manipulating the del argument, an attacker can insert arbitrary SQL code, allowing read, modify or delete operations against the database. This flaw is classified under CWE-74 and CWE-89 and can compromise the confidentiality and integrity of the system’s data.

Itsourcecode Online Cake Ordering System, version 1.0, is affected. The flaw resides in an unknown function within the transactionsave.php file, but the system’s transaction saving functionality is at risk.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The flaw can be exploited remotely over the web interface, and the exploit has been publicly disclosed. Without a publicly released patch, attackers may target the vulnerable parameter to gain unauthorized database access, though the likelihood of exploitation remains uncertain due to the lack of widespread automated tools for this specific issue.