The Bakeshop Online Ordering System version 1.0 is vulnerable to an unauthenticated SQL injection attack that could lead to full database compromise.

The application fails to properly sanitize the phonenumber parameter in the /passwordrecover.php file, allowing an unauthenticated attacker to inject malicious SQL commands into the backend database.

Successful exploitation of this vulnerability allows unauthorized actors to read, modify, or delete sensitive information stored within the system database. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to total system compromise or unauthorized administrative access.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /passwordrecover.php endpoint at the network or web server level until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /passwordrecover.php containing SQL syntax characters, such as single quotes, semicolons, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting the phonenumber parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the researcher's technical write-up on GitHub.

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents an immediate risk to any exposed Bakeshop Online Ordering System deployment. Organizations should prioritize isolating the affected application from public-facing networks and implement strict input validation controls to mitigate potential exploitation while awaiting a vendor-supplied fix.