A critical SQL injection vulnerability in the itsourcecode Online Cake Ordering System allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) triggered by improper validation of the ID parameter within the detailtransac.php script. The attack vector is network-based and does not require user interaction or authentication.

Successful exploitation allows an attacker to manipulate backend database queries, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of customer data managed by the system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the vulnerable detailtransac.php file if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests containing SQL syntax, such as UNION SELECT or tautologies, targeted at detailtransac.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns in URL parameters to mitigate the risk of exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up referenced on GitHub (https://github.com/LaneyYu/cve/issues/6).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for unauthorized traffic until the vendor provides a formal security update.