CVE-2026-114380 in Online Cake Ordering System
Summary
by MITRE • 10/21/2026
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within itsourcecode Online Cake Ordering System version 1.0, specifically affecting the file inserttrans.php through an unknown function that processes transaction data. This system flaw manifests as a SQL injection weakness triggered by manipulating the prcd argument passed to the application. The root cause of this issue is likely insufficient input validation and sanitization mechanisms within the backend logic responsible for handling user-supplied data before it is incorporated into database queries. When the prcd parameter is not properly escaped or validated against expected formats, an attacker can inject malicious SQL commands that are executed by the underlying database management system with the privileges of the web application process.
This vulnerability allows for remote exploitation without requiring any form of authentication, significantly lowering the barrier to entry for potential attackers. The ability to carry out this attack remotely means that individuals located anywhere on the internet can target the vulnerable instance provided it is accessible via a network connection. Since an exploit has already been made public, automated scanning tools and malicious actors are likely actively searching for instances of this specific software version or configuration. This increases the probability of successful compromise in environments where patching has not yet occurred or where legacy systems remain unmonitored.
The operational impact of such a SQL injection vulnerability is severe and multifaceted. An attacker can potentially read sensitive data from the database, including customer personal information, payment details, and order histories. Beyond data exfiltration, the vulnerability may allow for unauthorized modification of existing records or insertion of malicious entries into transaction tables. In more advanced scenarios involving specific database configurations, this could lead to remote code execution on the host server if functions like xp_cmdshell are available in Microsoft SQL Server or similar capabilities exist in other database engines. This compromises not only the confidentiality and integrity of the application but also potentially the availability of the service through data destruction or system instability caused by malformed queries.
To mitigate this risk, immediate remediation is required focusing on secure coding practices. Developers must implement parameterized queries or prepared statements for all database interactions involving user-supplied input, ensuring that data is treated strictly as values rather than executable code. Input validation should be enforced using allowlists to restrict the prcd argument to expected formats such as numeric IDs only. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by filtering out known malicious patterns associated with SQL injection attempts before they reach the application logic. Regular security audits and static analysis tools should also be employed to detect similar vulnerabilities across other parts of the codebase that may share the same flawed design pattern.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command within the Common Weakness Enumeration framework. It represents a classic injection flaw where untrusted data interferes with command structure. In terms of tactical mapping under the MITRE ATT&CK framework, this falls under T1190 Exploit Public-Facing Application and potentially T1059 Command and Scripting Interpreter if further exploitation leads to code execution. Understanding these classifications helps in prioritizing remediation efforts based on industry-standard risk assessments and ensures that security teams address both the immediate technical flaw and the broader systemic issues related to input handling and query construction within the application architecture.