CVE-2026-5811
SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error
- State
- Published
- Severity
- 5.3 Medium
- Published
- Apr 8, 2026
- Updated
- Apr 9, 2026
- Reserved
- Apr 8, 2026
Description
A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.5 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-840 Business Logic Errors
Affected Products
| Product | Versions |
|---|---|
Online Food Ordering SystemSourceCodester |
|
References
- VDB-356259 | SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic errorvdb-entrytechnical-description
- VDB-356259 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #787678 | SourceCodester Online Food Ordering System 1.0 Business Logic Errorsthird-party-advisory
- https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-NegativePrice.mdexploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.