{"id":"CVE-2026-114381","kind":"vulnerability","aliases":["CVE-2026-114381"],"related":[],"title":"Online Cake Ordering System: SQL injection via orderdetail.php ID parameter","description":"A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.","summary":"The itsourcecode Online Cake Ordering System 1.0 passes the ID argument of /orderdetail.php into a database query without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and the exploit has been publicly disclosed.","severity":"medium","cvss":6.5,"epss":0.00261,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","web-app"],"not_affected_if":["not-deployed","page-not-exposed"],"how_to_check":"- Check whether the application runs itsourcecode Online Cake Ordering System version `1.0` by reviewing the project files or deployment record\n- Look for the file `orderdetail.php` in the web root and review how the `ID` parameter is used in its SQL queries\n- unknown for any other check, as the sources do not say","fix":"- unknown: the sources do not name a patched version or vendor fix\n- Restrict access to `orderdetail.php` at the web server or until the query is changed to use prepared statements with bound parameters","status":"open","published_at":"2026-10-21T22:16:48+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:50+00:00","updated_at":"2026-10-25T03:48:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:48:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version or vendor fix\n- Restrict access to `orderdetail.php` at the web server or until the query is changed to use prepared statements with bound parameters","reach":"internet","title":"Online Cake Ordering System: SQL injection via orderdetail.php ID parameter","impact":"high","summary":"The itsourcecode Online Cake Ordering System 1.0 passes the ID argument of /orderdetail.php into a database query without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and the exploit has been publicly disclosed.","category":"package","nicknames":[],"who_cares":["php","self-hosted","web-app"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or modifies the application database remotely","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114381 for whether authentication is required and whether any fixed version exists.","how_to_check":"- Check whether the application runs itsourcecode Online Cake Ordering System version `1.0` by reviewing the project files or deployment record\n- Look for the file `orderdetail.php` in the web root and review how the `ID` parameter is used in its SQL queries\n- unknown for any other check, as the sources do not say","needs_analyst":true,"not_affected_if":["not-deployed","page-not-exposed"],"who_is_affected":"Teams that deploy the itsourcecode Online Cake Ordering System 1.0 web application with its orderdetail.php page reachable over the network. Deployments that do not run this project, or that block the page from remote users, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3357,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114381':13A,16A '-2026':12A,15A '/orderdetail.php':37B,87C '1.0':31B,76C 'affect':78C 'alter':54B 'app':24B 'applic':56B 'argument':35B,93C 'attack':47B,101C 'cake':2A,28B,73C 'cve':11A,14A 'databas':40B,58B 'determin':69C 'disclos':65B,112C 'element':79C 'execut':88C 'exploit':61B,108C 'file':86C 'function':83C 'host':21B 'id':9A,34B,94C 'inject':6A,49B,99C 'itsourcecod':26B,71C 'lead':96C 'manipul':90C 'may':102C,114C 'onlin':1A,27B,72C 'order':3A,29B,74C 'orderdetail.php':8A 'packag':17B 'paramet':10A 'pass':32B 'perform':104C 'php':18B 'proper':43B 'public':64B,111C 'queri':41B 'read':52B 'remot':46B,106C 'sanit':44B 'self':20B 'self-host':19B 'sql':5A,50B,98C 'system':4A,30B,75C 'unknown':82C 'util':116C 'via':7A 'vulner':67C 'web':23B 'web-app':22B 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy the itsourcecode Online Cake Ordering System 1.0 web application with its orderdetail.php page reachable over the network. Deployments that do not run this project, or that block the page from remote users, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114381","severity":null,"published_at":"2026-10-21T22:16:48+00:00","modified_at":"2026-10-23T22:16:56+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114381","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114381","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}