SourceCodester Ordering System EUVD-2026-110565

Exploitation targets the order submission handled by order.php, where the server enforces pricing/security decisions on the client side (CWE-602) and trusts the client-supplied price and title parameters - per the reference, carried in hidden form fields - rather than re-validating them server-side. The attacker must be able to reach and submit the order form remotely, and manipulation only yields the limited integrity impact of altering submitted order values (VI:L); there is no confidentiality or availability effect. Limiting factors: impact is confined to order/price integrity within this specific application, and while the CVSS vector states PR:N, in practice reaching the order workflow may require a customer session - this should be verified against the application's deployment, as it would raise the real privilege requirement.

This is a genuine but low-severity issue, not a high-priority emergency. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes trivially triggerable remote access, but the only impact is VC:N/VI:L/VA:N - a limited integrity effect with no confidentiality or availability loss, consistent with CWE-602 (client-side enforcement of server-side security). The signals align toward low real-world risk: EPSS is 0.30% (23rd percentile), there is no CISA KEV listing, and vuln.today assigns a 'this_month' priority rather than act_now or emergency. The CVSS 4.0 vector carries E:P (proof-of-concept), matching the input note that a PoC reference exists but is not verified as working exploit code. Net: a real parameter-tampering flaw worth scheduled remediation, but the low EPSS, absence of KEV, modest CVSS of 5.5, and unverified PoC all argue against treating it as an active threat. One caveat to verify with the vendor: placing an order in this application may in practice require a logged-in customer account, which the CVSS PR:N does not reflect; authentication requirements are not confirmed from the available data.

A remote attacker interacting with the order workflow in order.php tampers with the price (and/or title) sent by the client - the GitHub reference describes amount tampering via hidden form fields - because the server trusts client-supplied values instead of re-validating them. This lets the attacker submit an order at a manipulated price. A public PoC reference exists but is not verified as working exploit code.