{"id":"CVE-2026-5811","state":"PUBLISHED","title":"SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error","description":"A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.","publishedAt":"2026-04-08T22:15:13.008Z","updatedAt":"2026-04-09T13:18:59.568Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Online Food Ordering System"],"affected":[{"vendor":"SourceCodester","product":"Online Food Ordering System","versions":[{"version":"1.0","status":"affected"}],"modules":["POST Parameter Handler"]}],"references":["https://vuldb.com/vuln/356259","https://vuldb.com/vuln/356259/cti","https://vuldb.com/submit/787678","https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-NegativePrice.md","https://www.sourcecodester.com/"],"weaknesses":["CWE-840"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5811.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5811","state":"PUBLISHED","datePublished":"2026-04-08T22:15:13.008Z","dateUpdated":"2026-04-09T13:18:59.568Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-04-08T15:20:12.893Z"},"containers":{"cna":{"title":"SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error","descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used."}],"affected":[{"vendor":"SourceCodester","product":"Online Food Ordering System","versions":[{"version":"1.0","status":"affected"}],"modules":["POST Parameter Handler"]}],"references":[{"url":"https://vuldb.com/vuln/356259","name":"VDB-356259 | SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/356259/cti","name":"VDB-356259 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/787678","name":"Submit #787678 | SourceCodester Online Food Ordering System 1.0 Business Logic Errors","tags":["third-party-advisory"]},{"url":"https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-NegativePrice.md","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-840","type":"CWE","lang":"en","description":"Business Logic Errors"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-04-08T22:15:13.008Z"},"timeline":[{"time":"2026-04-08T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-04-08T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-04-08T17:25:17.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"FuKun (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-09T13:18:49.975627Z","id":"CVE-2026-5811","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-09T13:18:59.568Z"}}]}}}