| Title | SourceCodester Online Food Ordering System 1.0 Client-Side Enforcement of Server-Side Security |
|---|
| Description | The Online Food Ordering System distributed by SourceCodester contains a potential order-price manipulation vulnerability in order.php. The application accepts a price through the client-controlled POST parameter price and uses that value to calculate the order total.
In a local test installation, the listed burger price was 100000.00. Submitting an order with price=1.00 and qty=1 resulted in a database record containing a price and total of 1.
This demonstrates that the application does not enforce the authoritative product price when creating the tested order record. The issue may affect order-data integrity and could have further business impact if downstream processes trust these values. Payment manipulation and unauthorized fulfillment have not been verified.
The exact affected release remains unconfirmed. The finding was reproduced in a local lab environment. |
|---|
| Source | ⚠️ https://gist.github.com/shamillshaanuh/5d237b02f8aa69cad9ca6ea60509f0c9 |
|---|
| User | MUHAMMED SHAMIL (UID 102105) |
|---|
| Submission | 10/13/2026 11:20 (23 days ago) |
|---|
| Moderation | 11/04/2026 19:25 (22 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 426511 [SourceCodester Online Food Ordering System 1.0 order.php price/title client-side enforcement of server-side security] |
|---|
| Points | 0 |
|---|