SQL Injection in TOKO-ONLINE-ROTI Product Parameter Handling

A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-15490 represents a critical SQL injection vulnerability in RafyMrX TOKO-ONLINE-ROTI, specifically within the proses/add.php file where the kode_produk and kd_cs parameters are insufficiently sanitized before database queries. This vulnerability carries a CVSS score of 7.3 (high) and allows unauthenticated attackers to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access, modification, or deletion. Organizations running TOKO-ONLINE-ROTI installations—particularly small to medium-sized businesses using this e-commerce platform—face immediate risk, especially given the exploit's public availability and the platform's rolling release model that may complicate patch deployment tracking.

Casky's 322 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across two critical MITRE ATT&ACK techniques: TA0001 (Reconnaissance) and TA0043 (Reconnaissance, specifically initial scanning for injectable parameters). Practitioners using Casky would identify suspicious activity through detection of SQL metacharacters in HTTP request parameters (like single quotes, UNION statements, or comment sequences in kode_produk/kd_cs fields), abnormal database query patterns, and timing-based detection signatures. The platform's skills would correlate CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) with actual exploitation attempts, enabling teams to distinguish between benign requests and malicious payloads attempting to extract sensitive data or escalate privileges through the vulnerable add.php endpoint.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15490.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15490

Casky has 322 skills that investigate the attack patterns behind CVE-2026-15490. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn