CVE-2026-108959
6.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read or alter database contents via SQL injection. They only need low-privilege network access to the application.
Root cause
The application fails to sanitize or parameterize the 'ID' parameter in /addtransacdetail.php before using it in a SQL query.
Affected systems
itsourcecode Online Cake Ordering System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patched version is listed. Restrict access to /addtransacdetail.php via web server rules or edit the script to use parameterized prepared statements for the 'ID' parameter.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.