CVE-2026-114380: Online Cake Ordering System SQLI Vulnerability

CVE-2026-114380 Overview

CVE-2026-114380 is a SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw resides in the /inserttrans.php script, where the prcd parameter is passed to a database query without proper sanitization. An authenticated remote attacker can manipulate the parameter to inject arbitrary SQL statements. Public exploit details have been disclosed, lowering the barrier to exploitation. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers with low-level privileges can execute arbitrary SQL against the application database, exposing or modifying order, customer, and transaction data.

Affected Products

itsourcecode Online Cake Ordering System 1.0
Component: /inserttrans.php
Vulnerable parameter: prcd

Discovery Timeline

2026-10-21 - CVE-2026-114380 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114380

Vulnerability Analysis

The vulnerability exists in the transaction insertion handler /inserttrans.php of the Online Cake Ordering System. The script accepts the prcd HTTP parameter and concatenates it into a SQL statement without parameterized queries or input filtering. Attackers can append SQL syntax to the parameter to alter query logic, read arbitrary tables, or modify records.

The application requires low privileges, meaning an attacker needs an authenticated session before issuing the malicious request. According to the published advisory, a public proof of concept is available, which increases the likelihood of opportunistic exploitation against exposed instances.

Root Cause

The root cause is improper neutralization of user-controlled input before it is used in a downstream SQL interpreter [CWE-74]. The prcd parameter flows directly into a database query string, allowing SQL metacharacters to break out of the intended value context.

Attack Vector

The attack is carried out over the network against the HTTP endpoint handling inserttrans.php. An authenticated attacker submits a crafted request containing SQL payload fragments in the prcd parameter. Successful exploitation yields read and write access to the backend database within the privileges of the application's database user. Refer to the VulDB report for CVE-2026-114380 and the GitHub issue tracker entry for additional technical context.

Detection Methods for CVE-2026-114380

Indicators of Compromise

HTTP POST or GET requests to /inserttrans.php containing SQL syntax such as UNION SELECT, OR 1=1, --, or SLEEP( in the prcd parameter.
Database error messages or long response times originating from the inserttrans.php endpoint.
Unexpected rows, modified transaction records, or new administrative accounts in the application database.

Detection Strategies

Deploy web application firewall rules that inspect the prcd parameter and block SQL metacharacters sent to /inserttrans.php.
Enable verbose database query logging and alert on queries referencing inserttrans.php request paths that contain tautologies or stacked statements.
Correlate authenticated session activity with anomalous query patterns to identify abuse of low-privilege accounts.

Monitoring Recommendations

Monitor web server logs for repeated requests to /inserttrans.php from a single source with varying prcd values.
Alert on database errors emitted during request processing, which often indicate blind SQL injection probing.
Track outbound traffic from the database host for signs of data exfiltration following suspicious requests.

How to Mitigate CVE-2026-114380

Immediate Actions Required

Restrict public exposure of the Online Cake Ordering System until a vendor fix is applied, placing the application behind authenticated VPN or IP allowlists.
Deploy WAF signatures that block SQL injection payloads targeting the prcd parameter of /inserttrans.php.
Rotate database and application credentials if compromise is suspected, and review transaction records for integrity.

Patch Information

No vendor patch has been published for itsourcecode Online Cake Ordering System 1.0 at the time of CVE assignment. Review the IT Source Code project page and the VulDB vulnerability report #424738 for any updates on remediation availability.

Workarounds

Modify inserttrans.php to use prepared statements or parameterized queries for all database operations involving the prcd parameter.
Apply server-side input validation that restricts prcd to the expected data type and character set before query execution.
Enforce the principle of least privilege on the database account used by the application, limiting it to the specific tables required by the ordering workflow.

bash

# Configuration example
# Example ModSecurity rule to block SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /inserttrans.php" \
  "id:1026114380,phase:2,deny,status:403,\
   msg:'CVE-2026-114380 SQLi attempt on prcd parameter',\
   chain"
  SecRule ARGS:prcd "@detectSQLi" "t:none,t:urlDecodeUni"