Soumettre #1022965: SourceCodester Online Food Ordering System in PHP and MySQL Source Code 1.0 Amount Tampering via Hidden Form Fields

SourceCodester Online Food Ordering System in PHP and MySQL Source Code
Order Price/Amount Tampering via Hidden Form Fields

VENDOR
SourceCodester

PRODUCT
Online Food Ordering System in PHP and MySQL Source Code
Product URL: https://www.sourcecodester.com/php/18232/food-order-system.html

VULNERABILITY
The order handler trusts the submitted product price instead of calculating it from the server-side product record. A customer can tamper with the order amount (CWE-602).

Discovered by: Shailendra Mourya (CyberShailendra)
Affected file: order.php
Report date: 2026-10-10
Status: Reported as reproduced on a local XAMPP test instance.

FINDING DETAILS

Title: Online Food Ordering System order.php Client-Side Price Trust / Business Logic Tampering
Affected file: order.php
Vulnerability type: Improper Trust of Client-Submitted Data (CWE-602) / Business Logic Error
Attack vector: Network (remote)
Authentication required: None — public ordering page
CVSS 3.1 vector (estimated): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 score (estimated): 7.1 (High)
Root cause: The food price and title are rendered into hidden form fields, then the server trusts the submitted values instead of retrieving the authoritative product data from the database.
Proof of concept: Open order.php?id=16, edit the hidden price field in DevTools from 12300 to 1, then submit the order.
Observed impact: A customer can place an order for a product at a tampered near-zero price, potentially causing financial loss.
Confirmed by: Local XAMPP test instance, 2026-10-10; the order was reportedly accepted with the modified amount.
Remediation: Do not trust submitted prices or titles. Retrieve the food record by ID during order processing and calculate the total on the server.

TECHNICAL DETAILS — VULNERABLE CODE (order.php)

<?php
$id = $_GET['id'];
$sql = "select * from tbl_food where id=$id"; // SQL injection issue also reported in this flow
$execute = mysqli_query($conn, $sql);
$fetch = mysqli_fetch_assoc($execute);
?>

<form method="POST">
<input type="hidden" name="price" value="<?php echo $fetch['price'] ?>">
<input type="hidden" name="title" value="<?php echo $fetch['title'] ?>">
...
</form>

<?php
if(isset($_POST['submit'])){
$price = $_POST['price']; // attacker-controlled input
$title = $_POST['title']; // attacker-controlled input
$qty = $_POST['qty'];
$total = $price * $qty; // calculated using submitted price

$sql = "insert into tbl_order set customer_name='...', title='$title', price='$price', qty='$qty', total='$total', ...";
mysqli_query($conn, $sql);
}
?>

The form sends the food ID, price, and title back to the server. The handler uses the submitted price and title without looking up the current product record again, so changing the hidden values can change what is recorded for the order.

ROOT CAUSE ANALYSIS

Hidden fields are user-controlled input and cannot be trusted as the source of product prices. Since the ordering page is public, an unauthenticated customer can submit modified values unless the server retrieves the price from the database when processing the order.

REMEDIATION CODE

<?php
if(isset($_POST['submit'])){
$food_id = intval($_POST['food_id']);
$qty = max(1, intval($_POST['qty']));

// Re-fetch the authoritative product record from the database.
$sql = "SELECT title, price FROM tbl_food WHERE id=? AND active='yes'";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $food_id);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);
$food = mysqli_fetch_assoc($result);

if(!$food){
$errors[] = "Selected food is not available";
} else {
$title = $food['title'];
$price = (float) $food['price'];
$total = $price * $qty; // computed server-side only

$ins = "INSERT INTO tbl_order SET customer_name=?, title=?, price=?, qty=?, total=?";
$stmt2 = mysqli_prepare($conn, $ins);
mysqli_stmt_bind_param($stmt2, "ssdid", $customer_name, $title, $price, $qty, $total);
mysqli_stmt_execute($stmt2);
}
}
?>

The safest fix is to remove hidden price and title inputs, keep only the food ID, and regenerate the total from the database record on the server.

SUMMARY

This vulnerability allows a customer to alter the submitted price through browser form data. If the order handler records that modified value without rechecking the product price, the order may be stored at the tampered amount.

• La source: ⚠️ https://github.com/CyberShailendra/SourceCodesterOrderPrice-AmountTamperingviaHiddenFormFields
• Utilisateur: CyberShailendra (UID 99999)
• Soumission: 10/10/2026 10:54 (il y a 17 jours)
• Modérer: 26/10/2026 17:02 (16 days later)
• Statut: Accepté
• Entrée VulDB: 426511 [SourceCodester Online Food Ordering System 1.0 order.php price/title]
• Points: 20