A critical SQL injection vulnerability in the itsourcecode Online Cake Ordering System allows unauthenticated remote attackers to manipulate database queries.

The application fails to properly sanitize user input in the ID argument within the /updatesupplier.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to unauthorized data exposure, modification, or deletion. Successful exploitation may result in a complete compromise of the application database, leading to potential data breaches of sensitive user information and significant reputational damage.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /updatesupplier.php endpoint or disable the affected module entirely.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax and alert on any unauthorized access attempts to the updatesupplier.php script.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious requests targeting the ID parameter.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses an elevated risk to all deployments of the Online Cake Ordering System version 1.0. Organizations are strongly advised to isolate the affected system from external networks and apply compensating controls to prevent potential exploitation until a formal security update is released by the vendor.