CVE-2026-116605 Details
Description
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.
A business logic vulnerability has been identified in SourceCodester Online Food Ordering System version 1.0. The issue resides in the order.php file, where the application improperly trusts client-submitted price and title values. This flaw allows remote attackers to manipulate order amounts by altering hidden form fields, leading to unauthorized discounts and potential revenue loss. The vulnerability has been publicly disclosed and could be exploited.
The recommended remediation is to remove the hidden price and title inputs from the order form. Instead, retain only the food ID and fetch the product details from the database when processing the order. This ensures that the price is accurately retrieved and calculated server-side, preventing manipulation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CyberShailendra/SourceCodesterOrderPrice-AmountTamperingviaHiddenFormFields | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-116605 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1022965 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426511 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426511/cti | [email protected] | AdvisoryPermission Required |
| https://www.sourcecodester.com/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SourceCodester Online Food Ordering System | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |