Executive brief
A business logic vulnerability exists in the SourceCodester Online Food Ordering System, a web application used for managing food orders. An attacker with administrative access can manipulate product prices to be negative values. This can lead to financial discrepancies, such as orders that subtract money from a total bill instead of adding to it, potentially causing significant billing errors and operational disruption.
Technical details
A business logic vulnerability (CWE-840) exists in SourceCodester Online Food Ordering System 1.0. The root cause is a lack of server-side input validation in the 'save_product' function within '/Actions.php'. A remote attacker with low-level privileges (authenticated as an administrator) can submit a crafted POST request to the 'price' parameter containing a negative numerical value. Because the application fails to verify that prices are positive, the database accepts the invalid data. This results in corrupted financial logic where purchasing such items could deduct from a customer's total bill. A public proof-of-concept (PoC) is available.
Affected products
- SourceCodester Online Food Ordering System 1.0
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory