| शीर्षक | SourceCodester Online Food Ordering System 1.0 Client-Side Enforcement of Server-Side Security |
|---|
| विवरण | The Online Food Ordering System distributed by SourceCodester contains a potential order-price manipulation vulnerability in order.php. The application accepts a price through the client-controlled POST parameter price and uses that value to calculate the order total.
In a local test installation, the listed burger price was 100000.00. Submitting an order with price=1.00 and qty=1 resulted in a database record containing a price and total of 1.
This demonstrates that the application does not enforce the authoritative product price when creating the tested order record. The issue may affect order-data integrity and could have further business impact if downstream processes trust these values. Payment manipulation and unauthorized fulfillment have not been verified.
The exact affected release remains unconfirmed. The finding was reproduced in a local lab environment. |
|---|
| स्रोत | ⚠️ https://gist.github.com/shamillshaanuh/5d237b02f8aa69cad9ca6ea60509f0c9 |
|---|
| उपयोगकर्ता | MUHAMMED SHAMIL (UID 102105) |
|---|
| सबमिशन | 13/10/2026 11:20 AM (23 दिन पहले) |
|---|
| संयम | 04/11/2026 07:25 PM (22 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 426511 [SourceCodester Online Food Ordering System 1.0 order.php price/title] |
|---|
| अंक | 0 |
|---|