This vulnerability involves SQL injection in the RafyMrX TOKO-ONLINE-ROTI application, specifically in the proses/add.php file. Attackers can exploit improper input validation of the kode_produk or kd_cs arguments to execute arbitrary SQL commands remotely. The product's rolling release model prevents precise version identification of affected or patched releases. No official remediation or patch has been provided by the vendor, who did not respond to the disclosure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform SQL injection, potentially leading to unauthorized data access or manipulation within the affected database. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts according to the CVSS 4.0 vector. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should consider implementing input validation or web application firewall (WAF) rules to detect and block malicious input targeting kode_produk or kd_cs parameters as a temporary mitigation.