An unauthenticated SQL injection vulnerability in the itsourcecode Online Cake Ordering System 1.0 poses a significant risk to database integrity and data confidentiality.

This vulnerability is a SQL injection flaw (CWE-89) triggered through the ID parameter in the updatecustomer.php file. The issue allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

The ability to execute arbitrary SQL commands provides an attacker with the potential to bypass authentication, extract sensitive customer information, or modify application data. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage and the compromise of personally identifiable information stored within the system.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable updatecustomer.php endpoint until a fix is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing SQL syntax or unusual characters directed at the updatecustomer.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to protect the application from exploitation attempts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

The presence of a publicly disclosed proof-of-concept significantly lowers the barrier for attackers to compromise this system. Given the lack of a vendor-supplied patch, immediate containment via network isolation or WAF filtering is required to prevent unauthorized database access. Organizations should prioritize migrating away from this unsupported or unpatched software if a vendor security update is not provided in a timely manner.