CVE-2026-113740: SQL Injection in itsourcecode Online Cake Ordering System

The vulnerability CVE-2026-113740 affects itsourcecode Online Cake Ordering System version 1.0. It is an SQL injection flaw in an unspecified functionality within the /deletecustomer.php file. The issue arises from improper sanitization or validation of the ID parameter, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with attack vector network, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. Exploit code has been published, indicating potential for exploitation, although no active in-the-wild exploitation is currently known.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and apply input validation or web application firewall rules to mitigate SQL injection risks.