PT-2026-31549 · Sourcecodester · Sourcecodester Online Food Ordering System

Fukun · Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-5811

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Online Food Ordering System version 1.0

Description A vulnerability exists in the function save product of the file /Actions.php within the POST Parameter Handler component. Manipulation of the price argument can lead to business logic errors. The attack can be performed remotely, and an exploit is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /Actions.php file or disabling the save product function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-840

Related Identifiers

CVE-2026-5811

Affected Products

Sourcecodester Online Food Ordering System

References · 9

• 🔥 https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-NegativePrice.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5811 · Security Note
• https://vuldb.com/vuln/356259 · Note
• https://twitter.com/CVEnew/status/2042010558241607972 · Twitter Post
• https://vuldb.com/vuln/356259/cti · Note
• https://sourcecodester.com · Note
• https://vuldb.com/submit/787678 · Note
• https://twitter.com/infoflowcloud/status/2042013126124581034 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042131652499980707 · Twitter Post