PT-2026-5315 · Unknown · Bhojon All-In-One Restaurant Management System

4M3Rr0R · Published 2026-01-29 · Updated 2026-01-29 · CVE-2026-1599

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bdtask Bhojon All-In-One Restaurant Management System versions up to 20260116

Description A business logic issue exists in the Checkout component of Bdtask Bhojon All-In-One Restaurant Management System. The issue is related to the manipulation of the orggrandTotal, vat, service charge, and grandtotal arguments within the file '/hungry/placeorder'. This manipulation can lead to business logic errors and can be exploited remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 20260116 should be updated. As a temporary workaround, restrict or carefully validate the orggrandTotal, vat, service charge, and grandtotal arguments in the '/hungry/placeorder' file.

Exploit

Fix

Weakness Enumeration

CWE-840

Related Identifiers

CVE-2026-1599

Affected Products

Bhojon All-In-One Restaurant Management System

References · 9

• 🔥 https://github.com/4m3rr0r/PoCVulDb/issues/13 · Exploit
• 🔥 https://youtube.com/watch?v=n7xLBAOrKAU · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1599 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1599 · Vendor Advisory
• https://twitter.com/CVEnew/status/2016934792688816542 · Twitter Post
• https://vuldb.com/?ctiid.343361 · Note
• https://vuldb.com/?submit.740740 · Note
• https://vuldb.com/?id.343361 · Note
• https://twitter.com/VulmonFeeds/status/2016962972925513983 · Twitter Post