CVE-2026-13571: SourceCodester Simple Food Ordering System Price Manipulation Vulnerability

Technical summary

CVE-2026-13571 is a business logic vulnerability affecting SourceCodester Simple Food Ordering System 1.0. The flaw exists in /cart.php where insufficient validation of the item_price parameter allows remote attackers to manipulate product pricing without authorization. The vulnerability maps to CWE-840 (Business Logic Errors) and is characterized by a lack of proper input validation and server-side price verification. An attacker can intercept or directly supply modified price values, causing the system to process transactions at altered rates. The CVSS 3.1 score of 5.3 (Medium severity) reflects the integrity impact without requiring authentication or user interaction, though confidentiality and availability are not directly affected.

Business impact

Organizations running SourceCodester Simple Food Ordering System 1.0 face direct revenue loss through price manipulation attacks. Customers may exploit the vulnerability to place orders at significantly reduced prices, bypassing payment controls. This introduces financial risk, potential chargebacks, and reputational damage if customers discover the weakness before remediation. For restaurants or food vendors relying on this system, the ability to alter transaction amounts undermines profit margins and inventory management. Additionally, the published exploit status increases the likelihood of active exploitation by both sophisticated and opportunistic threat actors.

Affected systems

The vulnerability specifically affects SourceCodester Simple Food Ordering System version 1.0. Any deployment of this exact version with an internet-facing /cart.php endpoint is at risk. This includes small restaurants, food delivery platforms, and catering services using this open-source or licensed offering. Systems isolated to internal networks or behind authentication gateways have reduced exposure, but any direct internet access to the cart functionality creates exploitability risk.

Exploitability

Exploitation is straightforward and requires no special privileges, authentication, or user interaction. An attacker can craft HTTP requests to /cart.php with modified item_price parameters, or manipulate price values during checkout. The published exploit status indicates proof-of-concept code or detailed attack instructions are publicly available, lowering the barrier to entry for attackers. The attack surface is broad: any endpoint accepting price data without server-side validation is a potential entry point. Active exploitation is likely given the public disclosure and ease of execution.

Remediation

Immediate action is required. Organizations should contact SourceCodester for patches or upgrade guidance for version 1.0. Remediation should focus on implementing server-side price validation: prices must be retrieved from a protected database or backend service, never accepted from user input. All price modifications in /cart.php must be validated against the authoritative product catalog before processing. Implement rate limiting and request logging on cart endpoints to detect anomalous activity. Consider temporarily restricting cart access to authenticated users until patches are applied. As an interim measure, monitor transaction logs for orders with prices significantly below standard rates.

Patch guidance

Verify with SourceCodester's official advisory or downloads page for patches addressing CVE-2026-13571 in version 1.0. Apply patches immediately upon availability, testing thoroughly in a staging environment before production deployment. If no patch is forthcoming, evaluate migration to an alternative, actively maintained ordering system. Ensure all instances of the application are updated; verify that backup or mirror installations are not overlooked.

Detection guidance

Monitor /cart.php access logs for requests with unusual or suspiciously low item_price values. Implement Web Application Firewall (WAF) rules to detect and block requests that modify price parameters. Log all cart modifications and flag transactions with prices substantially lower than product master data. Review payment processor logs for chargebacks or declined transactions paired with anomalous order amounts. Search for HTTP POST/GET requests to /cart.php containing numeric price values that deviate from expected product pricing. Set alerts on sudden spikes in low-value orders from the same source IP or within short time windows.

Why prioritize this

While the CVSS score of 5.3 is moderate, the practical business impact is high: direct financial loss with no confidentiality or availability component. The published exploit status and ease of execution elevate risk significantly. For food ordering systems processing real transactions, even a single manipulated order represents tangible revenue loss. The lack of authentication or user interaction required makes this an attractive target. Organizations should treat this as high-priority for patching despite the moderate CVSS rating due to business logic criticality and active exploitation likelihood.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-accessible vulnerability requiring no privilege or user interaction, with limited integrity impact. However, this scoring does not fully capture business risk: the integrity impact directly translates to financial loss. The absence of authentication (PR:N) and straightforward exploitation (AC:L) are significant aggravating factors. The score appropriately excludes confidentiality and availability, but organizations handling financial transactions should weight business impact more heavily than the numeric score suggests.

Frequently asked questions