CVE-2026-114380: SQL Injection in itsourcecode Online Cake Ordering System

The vulnerability CVE-2026-114380 affects itsourcecode Online Cake Ordering System version 1.0. It is an SQL injection flaw located in an unspecified function within the /inserttrans.php file. By manipulating the 'prcd' parameter, an attacker can inject SQL commands remotely without authentication or user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and low privileges required. Public exploit code exists, but no confirmed active exploitation has been observed. No vendor advisory or patch information is provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or deletion depending on the database privileges of the application. The vulnerability requires low privileges and no user interaction, increasing its risk. However, the overall impact is rated medium due to limited details on the extent of database access and no confirmed active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the vulnerable endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'prcd' parameter. Monitor for updates from the vendor regarding official patches or mitigations.