| Titel | Bdtask Bhojon All-In-One Restaurant Management System latest Business Logic Errors |
|---|
| Beschreibung | A severe Checkout Price Manipulation vulnerability affects the Bhojon All-In-One Restaurant Management System due to insecure trust of client-supplied pricing data. During the order submission process, the /hungry/placeorder endpoint receives pricing fields such as orggrandTotal, vat, service_charge, and grandtotal directly from the client. The backend does not validate, recalculate, or enforce integrity of these values. Consequently, an attacker can intercept the request and modify the final amount to an arbitrarily low number—such as grandtotal=1.0—and the server accepts the order without verification. This business logic flaw enables complete payment bypass, VAT and fee manipulation, fraudulent order placement, and mass exploitation through automated scripts or bots, leading to significant revenue loss for businesses using this platform. |
|---|
| Quelle | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/13 |
|---|
| Benutzer | 4m3rr0r (UID 85795) |
|---|
| Einreichung | 16.01.2026 11:34 (vor 5 Monaten) |
|---|
| Moderieren | 29.01.2026 09:44 (13 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 343361 [Bdtask Bhojon All-In-One Restaurant Management System bis 20260116 Checkout /hungry/placeorder orggrandTotal/vat/service_charge/grandtotal] |
|---|
| Punkte | 20 |
|---|