{"id":"CVE-2026-112087","kind":"vulnerability","aliases":["CVE-2026-112087"],"related":[],"title":"itsourcecode Online Cake Ordering System: SQL injection in confirm.php cancel parameter","description":"A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.","summary":"The itsourcecode Online Cake Ordering System 1.0 does not sanitize the cancel argument passed to confirm.php, which allows SQL injection. A remote attacker can send crafted requests to read or alter the application's database.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","sql-injection"],"not_affected_if":["not-installed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-19T07:16:30+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:22+00:00","updated_at":"2026-10-25T03:57:22+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:57:22Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"itsourcecode Online Cake Ordering System: SQL injection in confirm.php cancel parameter","impact":"medium","summary":"The itsourcecode Online Cake Ordering System 1.0 does not sanitize the cancel argument passed to confirm.php, which allows SQL injection. A remote attacker can send crafted requests to read or alter the application's database.","category":"other","nicknames":[],"who_cares":["php","self-hosted","sql-injection"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker reads or modifies the application's database contents","analyst_note":"Check the NVD entry and any vendor or project page for a patched version or workaround, and confirm whether authentication is required to reach confirm.php.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Sites running itsourcecode Online Cake Ordering System 1.0 with confirm.php reachable from the internet are exposed. Installations that do not use this application can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000538,"input_tokens":3310,"output_tokens":414,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112087':14A,17A '-2026':13A,16A '1.0':32B,72C 'affect':75C 'allow':43B 'alter':56B 'applic':58B 'argument':38B,87C 'attack':48B,93C,112C 'avail':103C 'cake':3A,29B,69C 'cancel':10A,37B,88C 'caus':89C 'confirm.php':9A,41B,82C 'could':108C 'craft':51B 'cve':12A,15A 'databas':60B 'exploit':99C 'file':81C 'host':22B 'identifi':65C 'initi':96C 'inject':7A,25B,45B,91C 'issu':74C 'itsourcecod':1A,27B,67C 'made':102C 'manipul':84C 'may':94C 'onlin':2A,28B,68C 'order':4A,30B,70C 'paramet':11A 'pass':39B 'php':19B 'process':78C 'public':106C 'read':54B 'remot':47B,97C 'request':52B 'sanit':35B 'self':21B 'self-host':20B 'send':50B 'sql':6A,24B,44B,90C 'sql-inject':23B 'system':5A,31B,71C 'unknown':77C 'use':110C 'weak':62C","nicknames":[],"mitigations":[],"who_affected":"Sites running itsourcecode Online Cake Ordering System 1.0 with confirm.php reachable from the internet are exposed. Installations that do not use this application can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T07:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112087","severity":null,"published_at":"2026-10-19T07:16:30+00:00","modified_at":"2026-10-22T03:16:34+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}