CVE-2026-15489

RafyMrX TOKO-ONLINE-ROTI login.php sql injection

View on CVE.org
Published Jul 12, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw exists in the login functionality of RafyMrX TOKO-ONLINE-ROTI where tampering with the Username field permits a remote attacker to inject arbitrary SQL code. The consequence is unauthorized access to the database, potentially exposing sensitive information or allowing further compromise. The issue is classified by CWE-74 and CWE-89 for SQL injection weaknesses.

Affected Systems

The affected product is RafyMrX's TOKO-ONLINE-ROTI, specifically any deployment tied to or newer than the commit identifier ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. No explicit release numbers are provided, as the vendor uses a rolling release schedule, so any instance running that codebase is likely vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating moderate severity. Its EPSS score is below 1%, suggesting that spontaneous exploitation attempts are uncommon, but the exploit code is publicly available and remote exploitation is straightforward via the login endpoint. The vulnerability is not listed in CISA KEV, so there is no known widespread active exploitation as of the last update.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict access to the login endpoint to known, trusted IP addresses or VPN connections.
  • Deploy a web application firewall that detects and blocks typical SQL injection patterns before they reach the application.
  • Apply a patch or upgrade when the vendor releases a fix for the identified issue; if no fix is available, modify the code to use prepared statements or parameterized queries for all database interactions.
  • Configure automated monitoring of authentication logs to detect unusual login attempts or suspicious SQL patterns.

Generated by OpenCVE AI on July 31, 2026 at 12:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Title RafyMrX TOKO-ONLINE-ROTI login.php sql injection
First Time appeared Rafymrx
Rafymrx toko-online-roti
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:rafymrx:toko-online-roti:*:*:*:*:*:*:*:*
Vendors & Products Rafymrx
Rafymrx toko-online-roti
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 4:08 PM
Reserved
Jul 11, 2026, 11:55 AM

View source JSON

Updated
Jul 15, 2026, 4:07 PM

JSON

Status
Deferred
Published
Jul 12, 2026, 9:16 AM
Modified
Oct 25, 2026, 3:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:30 PM

JSON