CVE-2026-15502 is a SQL injection vulnerability affecting AojiaoZero Antaris 1.0. The issue resides in the _rewardPurchase function of the /ipn.php file, specifically in the PayPal IPN Payment Handler component. An attacker can manipulate the item_number parameter to inject SQL code remotely. The vendor was contacted but did not provide any response or patch. No official remediation or workaround has been published. The vulnerability has a CVSS 4.0 score of 5.3, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the item_number parameter. This may lead to unauthorized data access or modification. However, the CVSS vector indicates low impact on confidentiality, integrity, and availability, suggesting limited but non-negligible risk.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is provided, consider implementing web application firewall (WAF) rules to detect and block suspicious SQL injection attempts targeting the item_number parameter in /ipn.php. Avoid exposing this endpoint unnecessarily and restrict access where possible.