A critical SQL injection vulnerability in the itsourcecode Online Cake Ordering System 1.0 permits unauthenticated attackers to gain unauthorized database access and potentially achieve full system control.

The application fails to properly sanitize the product parameter in the /cakeshop/product.php file, allowing unauthenticated remote attackers to inject malicious SQL commands. This flaw permits the manipulation of database queries, which can lead to unauthorized data extraction, modification, or deletion.

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain direct access to the backend database. This risk includes the potential for sensitive data exfiltration, total loss of data integrity, and service disruption. While the CVSS score is 7.3, the ability for an unauthenticated attacker to perform these actions poses a severe threat to the confidentiality and availability of the organization’s business data.

Immediate Action: As no vendor patch is currently available, administrators should restrict network access to the application and implement strict input validation at the Web Application Firewall level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /cakeshop/product.php containing SQL syntax characters, such as single quotes, semicolons, or time-based sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block SQL injection patterns specifically targeting the product parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability report.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to any environment hosting this software. Organizations should prioritize isolating the affected system from public-facing networks until the vendor provides a secure update or the codebase is remediated by implementing prepared statements and rigorous input filtering.