Description
A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-07-12
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in RafyMrX TOKO-ONLINE-ROTI allows an attacker to inject arbitrary SQL by manipulating the kode_produk and kd_cs parameters in add.php. The injection can be triggered through a crafted remote request, potentially compromising the confidentiality and integrity of the database. The weakness is recognized as a combination of CWE-74 and CWE-89 vulnerabilities, and a public exploit has been released.

Affected Systems

All releases of the Toko‑Online‑Roti application, including those up to the commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99, are affected. Because the product follows a rolling‑release model, explicit version numbers are not provided and any current production deployment may be vulnerable until a fix is applied.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating medium severity, and an EPSS score of less than 1 %. It is not listed in the CISA KEV catalogue. The attack vector is remote; a malicious actor can trigger the injection by sending a crafted request to add.php. The low EPSS score suggests a low likelihood of exploitation, but the risk is contingent on the application's exposure to the internet.

Generated by OpenCVE AI on August 1, 2026 at 11:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Seek an official vendor update to address the SQL injection flaw.
  • Validate and sanitize the kode_produk and kd_cs parameters on the server side to allow only expected input.
  • Alter the database user privileges to read‑only or to the minimum necessary to limit the impact of a successful injection.
  • If the add.php functionality is not essential, disable or remove it as a temporary measure.

Generated by OpenCVE AI on August 1, 2026 at 11:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Title RafyMrX TOKO-ONLINE-ROTI add.php sql injection
First Time appeared Rafymrx
Rafymrx toko-online-roti
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:rafymrx:toko-online-roti:*:*:*:*:*:*:*:*
Vendors & Products Rafymrx
Rafymrx toko-online-roti
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Rafymrx Toko-online-roti
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-13T16:27:09.290Z

Reserved: 2026-07-11T11:58:39.924Z

Link: CVE-2026-15490

cve-icon Vulnrichment

Updated: 2026-07-13T16:27:05.267Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T11:15:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')