CVE-2026-15502 describes a SQL injection vulnerability in AojiaoZero Antaris 1.0. The issue is located in the _rewardPurchase function within the /ipn.php file of the PayPal IPN Payment Handler component. An attacker can manipulate the item_number parameter to inject SQL commands remotely. There is no evidence of known exploits in the wild, and the vendor has not provided any response or patch. The vulnerability has a CVSS 4.0 score of 5.3, reflecting medium severity with network attack vector, low attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the item_number parameter. This may lead to unauthorized data access or modification. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability (low to low impact), and no known active exploitation has been reported.

No official fix or patch is currently available from the vendor, as they have not responded to disclosure attempts. Users of AojiaoZero Antaris 1.0 should consider implementing application-level input validation and sanitization for the item_number parameter as a temporary mitigation. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.