{"id":"CVE-2026-116605","kind":"vulnerability","aliases":["CVE-2026-116605"],"related":[],"title":"SourceCodester Online Food Ordering System: order.php trusts client-side price values","description":"A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.","summary":"The SourceCodester Online Food Ordering System 1.0 relies on client-side checks for server-side security in order.php, so a remote attacker can manipulate the price or title argument. The exploit has been published and could be used.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","web-app"],"not_affected_if":["not-using-sourcecodester-food-ordering"],"how_to_check":"- Check whether the application runs SourceCodester Online Food Ordering System version `1.0` by reviewing the installed files\n- Look at `order.php` to see whether the price and title values are validated on the server\n- unknown for any other check, the sources do not say","fix":"- unknown, the sources do not name a patched version or vendor fix\n- Until a fix is confirmed, validate price and title values on the server before saving orders","status":"open","published_at":"2026-10-27T01:19:05+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:31+00:00","updated_at":"2026-10-27T01:36:31+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T01:36:31Z","model":"claude-haiku-5-5","output":{"fix":"- unknown, the sources do not name a patched version or vendor fix\n- Until a fix is confirmed, validate price and title values on the server before saving orders","reach":"internet","title":"SourceCodester Online Food Ordering System: order.php trusts client-side price values","impact":"medium","summary":"The SourceCodester Online Food Ordering System 1.0 relies on client-side checks for server-side security in order.php, so a remote attacker can manipulate the price or title argument. The exploit has been published and could be used.","category":"other","nicknames":[],"who_cares":["php","self-hosted","web-app"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker alters order prices and titles through remote requests","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116605 for affected file details, whether authentication is needed, and any patch or workaround.","how_to_check":"- Check whether the application runs SourceCodester Online Food Ordering System version `1.0` by reviewing the installed files\n- Look at `order.php` to see whether the price and title values are validated on the server\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["not-using-sourcecodester-food-ordering"],"who_is_affected":"Teams running the SourceCodester Online Food Ordering System 1.0 PHP application on their own servers are exposed, since the flaw is in how order.php handles submitted values. Teams not running this specific application can skip it, and the sources do not say whether other versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3309,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116605':15A,18A '-2026':14A,17A '1.0':33B,77C 'app':26B 'argument':57B,93C 'attack':50B,112C 'check':39B 'client':9A,37B,98C 'client-sid':8A,36B,97C 'could':64B,121C 'cve':13A,16A 'element':80C 'enforc':100C 'exploit':59B,115C 'file':87C 'food':3A,30B,74C 'found':70C 'function':84C 'host':23B 'impact':79C 'launch':110C 'made':118C 'manipul':52B,90C 'onlin':2A,29B,73C 'order':4A,31B,75C 'order.php':6A,46B,88C 'php':20B 'possibl':108C 'price':11A,54B 'price/title':94C 'public':119C 'publish':62B 'reli':34B 'remot':49B,113C 'result':95C 'secur':44B,105C 'self':22B 'self-host':21B 'server':42B,103C 'server-sid':41B,102C 'side':10A,38B,43B,99C,104C 'sourcecodest':1A,28B,72C 'system':5A,32B,76C 'titl':56B 'trust':7A 'unknown':83C 'use':66B,123C 'valu':12A 'vulner':68C 'web':25B 'web-app':24B","nicknames":[],"mitigations":[],"who_affected":"Teams running the SourceCodester Online Food Ordering System 1.0 PHP application on their own servers are exposed, since the flaw is in how order.php handles submitted values. Teams not running this specific application can skip it, and the sources do not say whether other versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116605","severity":null,"published_at":"2026-10-27T01:19:05+00:00","modified_at":"2026-10-27T01:19:05+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}