CVE-2026-113740: Online Cake Ordering System SQLi Flaw

CVE-2026-113740 Overview

CVE-2026-113740 is a SQL injection vulnerability in itsourcecode Online Cake Ordering System 1.0. The flaw resides in the /deletecustomer.php script, where the ID parameter is passed to a database query without sanitization. Remote attackers with low-privileged access can manipulate the ID argument to inject arbitrary SQL statements. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed deployments. The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote attackers can inject SQL commands through the ID parameter of /deletecustomer.php, exposing or modifying backend database records in affected deployments.

Affected Products

itsourcecode Online Cake Ordering System 1.0
Component: /deletecustomer.php
Vulnerable parameter: ID

Discovery Timeline

2026-10-21 - CVE-2026-113740 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113740

Vulnerability Analysis

The vulnerability exists in the /deletecustomer.php endpoint of itsourcecode Online Cake Ordering System 1.0. The script accepts an ID parameter supplied via HTTP request and concatenates it into a backend SQL statement without parameterized binding or input validation. An attacker who can reach the application over the network can submit crafted values that break out of the intended query context. Exploitation requires low-level privileges but no user interaction. The EPSS probability stands at 0.2% as of 2026-10-22, reflecting limited current scanning activity despite a published proof of concept.

Root Cause

The root cause is improper neutralization of user-controlled input before it is placed into a SQL query, aligning with [CWE-74]. The ID parameter in /deletecustomer.php is interpolated directly into the DELETE statement issued against the backend database. No prepared statements, type casting, or allow-list filtering guard the parameter.

Attack Vector

Attackers submit HTTP requests to /deletecustomer.php with a malicious value in the ID parameter. By appending SQL control characters and sub-statements, they alter the query logic to read, modify, or delete records beyond the intended scope. The attack is executed remotely over the network and does not require administrative privileges. Public disclosure of exploitation details on VulDB and a related GitHub issue increases exposure for internet-facing instances. See the VulDB Vulnerability Details and the GitHub Issue Discussion for further technical context.

Detection Methods for CVE-2026-113740

Indicators of Compromise

HTTP requests to /deletecustomer.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the ID parameter.
Web server access logs showing repeated requests to /deletecustomer.php from a single source with varying ID values.
Database error messages or unexpected DELETE operations originating from the application service account.

Detection Strategies

Deploy web application firewall rules that inspect query strings and POST bodies submitted to /deletecustomer.php for SQL injection patterns.
Correlate web access logs with database audit logs to identify queries that deviate from the application's expected statement templates.
Flag any numeric parameter that contains non-numeric characters before reaching the database layer.

Monitoring Recommendations

Enable verbose query logging on the MySQL or MariaDB backend to capture tampered DELETE statements.
Monitor for anomalous customer record deletions or data exfiltration spikes from the application host.
Alert on HTTP 500 responses from /deletecustomer.php, which often indicate failed injection attempts.

How to Mitigate CVE-2026-113740

Immediate Actions Required

Restrict access to /deletecustomer.php to trusted administrative networks via firewall or reverse proxy rules.
Place the application behind a web application firewall configured with SQL injection signatures.
Audit the backend database for unauthorized deletions or modifications to the customer table.

Patch Information

No vendor patch has been published for itsourcecode Online Cake Ordering System 1.0 at the time of writing. Operators should monitor the IT Source Code site and the VulDB CVE Analysis entry for updates. Where feasible, replace the vulnerable code path with parameterized queries using PDO or mysqli prepared statements.

Workarounds

Rewrite the /deletecustomer.php query to use prepared statements with bound parameters, treating ID as an integer.
Add server-side input validation that rejects any non-numeric ID value before query execution.
Enforce authentication and role-based access control so that only authorized administrators can invoke customer deletion.

bash

# Example nginx rule to block non-numeric ID values submitted to deletecustomer.php
location = /deletecustomer.php {
    if ($arg_ID !~ "^[0-9]+$") {
        return 403;
    }
}