PT-2026-5315 · Unknown · Bhojon All-In-One Restaurant Management System

4M3Rr0R · Publicado 2026-01-29 · Atualizado 2026-01-29 · CVE-2026-1599

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bdtask Bhojon All-In-One Restaurant Management System versions up to 20260116

Description A business logic issue exists in the Checkout component of Bdtask Bhojon All-In-One Restaurant Management System. The issue is related to the manipulation of the orggrandTotal, vat, service charge, and grandtotal arguments within the file '/hungry/placeorder'. This manipulation can lead to business logic errors and can be exploited remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 20260116 should be updated. As a temporary workaround, restrict or carefully validate the orggrandTotal, vat, service charge, and grandtotal arguments in the '/hungry/placeorder' file.

Exploit

Correção

Enumeração de Fraquezas

CWE-840

Identificadores relacionados

CVE-2026-1599

Produtos afetados

Bhojon All-In-One Restaurant Management System

Referências · 9

• 🔥 https://github.com/4m3rr0r/PoCVulDb/issues/13 · Exploit
• 🔥 https://youtube.com/watch?v=n7xLBAOrKAU · Exploit
• https://twitter.com/CVEnew/status/2016934792688816542 · Publicação no Twitter
• https://vuldb.com/?ctiid.343361 · Nota
• https://vuldb.com/?submit.740740 · Nota
• https://vuldb.com/?id.343361 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1599 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2016962972925513983 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-1599 · Aviso do Fabricante