| タイトル | SourceCodester Online Food Ordering System 1.0 Client-Side Enforcement of Server-Side Security |
|---|
| 説明 | The Online Food Ordering System distributed by SourceCodester contains a potential order-price manipulation vulnerability in order.php. The application accepts a price through the client-controlled POST parameter price and uses that value to calculate the order total.
In a local test installation, the listed burger price was 100000.00. Submitting an order with price=1.00 and qty=1 resulted in a database record containing a price and total of 1.
This demonstrates that the application does not enforce the authoritative product price when creating the tested order record. The issue may affect order-data integrity and could have further business impact if downstream processes trust these values. Payment manipulation and unauthorized fulfillment have not been verified.
The exact affected release remains unconfirmed. The finding was reproduced in a local lab environment. |
|---|
| ソース | ⚠️ https://gist.github.com/shamillshaanuh/5d237b02f8aa69cad9ca6ea60509f0c9 |
|---|
| ユーザー | MUHAMMED SHAMIL (UID 102105) |
|---|
| 送信 | 2026年10月13日 11:20 (23 日 ago) |
|---|
| モデレーション | 2026年11月04日 19:25 (22 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 426511 [SourceCodester Online Food Ordering System 1.0 order.php price/title] |
|---|
| ポイント | 0 |
|---|