CVE-2026-15489
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A SQL injection vulnerability exists in the proses/login.php file of TOKO-ONLINE-ROTI (up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99) via the Username argument. Remote exploitation is possible and a public exploit is available.
Risk Assessment
The organization is at risk of unauthorized database access, potentially leading to data breaches, order manipulation, or system compromise.
Recommendation
Immediately update the application to the latest version (if available) or apply temporary mitigations such as input validation and parameterized SQL queries in proses/login.php.
Other vulnerabilities in TOKO-ONLINE-ROTI
See all- CVE-2026-15909Medium
A vulnerability was found in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 in an unknown function of the file proses/add.php. Manipulation of the argument kd_cs leads to authorization bypass. The attack can be carried out remotely.
- CVE-2026-15491High
A missing authentication vulnerability has been found in an unknown part of TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The flaw can be exploited remotely without authentication.
- CVE-2026-15490High
A security flaw has been discovered in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The vulnerability is an SQL injection in the proses/add.php file, where the kode_produk or kd_cs arguments can be manipulated remotely. The exploit has been publicly released and may be used in attacks.
Original NVD description (English source)
A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.