The Online Cake Ordering System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the underlying database.

This is a SQL injection vulnerability (CWE-89) located in the /cakeshop/supplier.php file. The application fails to sanitize the supplier POST parameter, allowing an unauthenticated attacker to manipulate database queries.

Successful exploitation of this flaw can lead to unauthorized access to sensitive application data, potential data exfiltration, and full database compromise. Given the CVSS score of 7.3, this vulnerability poses a significant risk to the integrity and confidentiality of the system, potentially resulting in complete service disruption or the exposure of customer information stored in the backend database.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /cakeshop/supplier.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /cakeshop/supplier.php, specifically looking for SQL syntax patterns or time-based delay functions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeted at the supplier parameter.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Due to the absence of a vendor-provided patch, users of the Online Cake Ordering System 1.0 must prioritize manual mitigation. Given the availability of public proof-of-concept code and the ease of exploitation, immediate network-level blocking or disabling of the vulnerable component is necessary to prevent potential database compromise.