This vulnerability in RafyMrX TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 allows remote attackers to perform SQL injection via manipulation of the kode_produk or kd_cs parameters in the proses/add.php file. The product's rolling release model prevents precise version identification. The vendor did not provide a response or patch, and public exploit code is available. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized SQL queries on the backend database, potentially exposing or modifying sensitive data. The attack can be performed remotely without authentication or user interaction. The impact on confidentiality, integrity, and availability is assessed as low to limited. Public exploit code availability increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing application-level mitigations such as input validation, parameterized queries, or web application firewalls to reduce risk until an official patch is released.