Simple Food Ordering System CVE-2026-13571

No special conditions are required beyond access to the web application - exploitation targets the unauthenticated cart submission endpoint /cart.php on any publicly or network-accessible instance of Simple Food Ordering System 1.0. The item_price argument must be present in the POST body and trusted by the server without re-validation, which is the default behavior of this application. Exploitation is limited by the need to have a reachable instance of this specific product; the software is not widely deployed in enterprise environments and is primarily used in educational or hobbyist contexts. No authentication, session privilege, or special browser state is required.

The CVSS 4.0 base score of 6.9 reflects network-reachable, unauthenticated, low-complexity exploitation with low integrity impact and no confidentiality or availability impact. The E:P environmental modifier confirms a public exploit exists. The impact is limited to business logic integrity - an attacker can place orders at manipulated prices but cannot achieve code execution, data exfiltration, or denial of service. Real-world risk is further constrained by the product's extremely limited deployment footprint: Sourcecodester distributes these scripts primarily as educational PHP code rather than production-grade software, significantly reducing the number of exposed instances. The product is not in CISA KEV and no EPSS data was provided, suggesting minimal observed exploitation in enterprise environments. This is a low-operational-impact vulnerability with a real-world risk profile considerably below its numeric CVSS score for most organizations.

An attacker identifies a publicly deployed instance of Simple Food Ordering System, adds items to the cart, and intercepts the HTTP POST request to /cart.php using a proxy tool such as Burp Suite. The attacker modifies the item_price parameter to a negligible value (e.g., 0.01) before forwarding the request, causing the system to record and process an order at the manipulated price. A public proof-of-concept demonstrating this technique is available on GitHub.