This vulnerability exists in an unknown functionality within proses/login.php of RafyMrX TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The Username argument is vulnerable to SQL injection, allowing remote exploitation without authentication or user interaction. The product follows a rolling release approach, so no explicit affected or fixed versions are identified. The vendor was contacted but did not provide any response or remediation information. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform SQL injection attacks via the Username parameter in the login process. This could lead to unauthorized data access or manipulation. The impact is rated medium based on the CVSS score of 6.9 and the low but present confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection. Monitor for vendor updates regarding official patches or fixes.