The itsourcecode Online Cake Ordering System is vulnerable to a critical unauthenticated SQL injection attack that can lead to unauthorized database access and potential system compromise.

This is a SQL injection vulnerability (CWE-89) located in the id parameter of the /cakeshop/updateproduct.php file. The application fails to sanitize user input, allowing an unauthenticated attacker to inject malicious SQL commands directly into database queries.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary SQL commands, resulting in unauthorized access to sensitive data, potential data modification or deletion, and complete control over the database backend. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality, integrity, and availability of the application, potentially leading to total service disruption and severe reputational damage.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the application via network-level controls or discontinue use until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, particularly those containing SQL syntax characters, strings like RLIKE or SLEEP, or unexpected database interaction errors.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the updateproduct.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research findings on GitHub.

The severity of this vulnerability, combined with the availability of public proof-of-concept material, necessitates immediate defensive action. Organizations utilizing the Online Cake Ordering System must prioritize isolating the affected component from the public internet to prevent unauthorized database access. Until an official update is provided by the vendor, assume the system is at high risk of exploitation.