EUVD-2026-40095
GHSA-vxhq-q9qm-8cqm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated POST parameter manipulation; scope unchanged; only integrity is impacted via price falsification, no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used.
AnalysisAI
Price parameter manipulation in SourceCodester Simple Food Ordering System 1.0 allows unauthenticated remote attackers to submit orders at arbitrary prices by modifying the item_price argument in POST requests to /cart.php. The server trusts client-supplied price data without server-side validation, enabling business logic bypass (CWE-840) that could result in financial loss for system operators. A public proof-of-concept exploit is available on GitHub; however, this vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
The affected product is SourceCodester Simple Food Ordering System 1.0, a PHP-based web application identified by CPE cpe:2.3:a:sourcecodester:simple_food_ordering_system:*:*:*:*:*:*:*:*. The root cause is CWE-840 (Business Logic Errors): the application's /cart.php endpoint accepts the item_price field from user-controlled HTTP request parameters and uses that value directly in order processing without re-validating the price against a server-side authoritative source (e.g., a database price lookup). This is a classic client-side trust flaw common in rudimentary PHP e-commerce scripts where price is embedded in a hidden form field or POST body rather than derived server-side from the product ID.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary fix is to remove client-supplied price data from the order submission flow in /cart.php and instead derive item prices exclusively from a server-side database lookup using only the product ID submitted by the user - never trust a price value from POST/GET parameters. As a compensating control until the code is corrected, operators can add server-side price validation that cross-checks submitted item_price values against the stored product price table before any order is recorded, rejecting requests where prices do not match. Alternatively, deploying a web application firewall rule to block requests to /cart.php where item_price deviates from expected price patterns can reduce exposure, though this requires maintenance as products and prices change. See VulDB advisory at https://vuldb.com/vuln/374579 and the public PoC at https://github.com/ogh-bnz/Simple-Food-Ordering-System/blob/main/Simple-Food-Ordering-System-Price-Manipulation.md for technical detail.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-840 – Business Logic Errors
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today