The Online Cake Ordering System is vulnerable to unauthenticated SQL injection, which may allow remote attackers to compromise the underlying database and gain complete control over the application.

This is a SQL injection vulnerability (CWE-89) located in the /cakeshop/admindetail.php file. The application fails to sanitize the id parameter during edit actions, allowing an unauthenticated attacker to manipulate database queries via crafted GET requests.

Successful exploitation allows an attacker to bypass authentication, extract sensitive user information, modify or delete database records, and potentially achieve full system compromise. Given the CVSS score of 7.3, this represents a high-risk security flaw that could lead to significant data breaches and total loss of confidentiality, integrity, and availability of the ordering system.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /cakeshop/admindetail.php endpoint or take the application offline until code-level sanitization is implemented.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for SQL syntax errors or unexpected patterns in GET requests directed at the admindetail.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the id parameter in GET requests.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub issue referenced by the vulnerability record.

Due to the ease of exploitation and the lack of a vendor-provided patch, this vulnerability poses a severe threat to any environment running the Online Cake Ordering System. Organizations should prioritize implementing strict input validation or removing the vulnerable component from public access immediately to prevent unauthorized database manipulation.