CVE-2026-13571: Food Ordering System Logic Vulnerability

CVE-2026-13571 Overview

CVE-2026-13571 is a business logic vulnerability in SourceCodester Simple Food Ordering System 1.0. The flaw resides in an unknown function of /cart.php, where the item_price argument can be manipulated by remote attackers. Because the application trusts client-supplied pricing data, attackers can alter the price of items before checkout. The issue is classified under CWE-840: Business Logic Errors. A public exploit description has been released, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Remote unauthenticated attackers can tamper with the item_price parameter in /cart.php to purchase items at attacker-controlled prices, causing direct financial loss to store operators.

Affected Products

SourceCodester Simple Food Ordering System 1.0
/cart.php endpoint accepting the item_price parameter
Deployments of the application exposed over the network

Discovery Timeline

2026-06-29 - CVE-2026-13571 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13571

Vulnerability Analysis

The Simple Food Ordering System handles cart operations in /cart.php. The endpoint accepts an item_price value from the client request rather than resolving the authoritative price from a server-side product record. This design mistake allows a remote attacker to submit an arbitrary price value and have it applied to the transaction total.

The issue maps to CWE-840: Business Logic Errors. It is not a memory safety flaw or an injection primitive. Instead, the application executes its intended workflow while accepting attacker-controlled inputs that should have been validated against server-side state.

Because no authentication is required and the attack occurs over standard HTTP, exploitation is trivial once a target instance is identified. Public write-ups documenting the manipulation method are available in the GitHub Price Manipulation Guide and on the VulDB entry for CVE-2026-13571.

Root Cause

The root cause is client-side trust for a security-relevant value. The item_price field is transmitted from the browser to /cart.php and consumed as authoritative. The server does not re-derive the price by looking up the product identifier in the database, and it does not validate the submitted value against expected ranges.

Attack Vector

An attacker intercepts or crafts an HTTP request to /cart.php and modifies the item_price parameter to a value of their choosing, such as zero or a nominal amount. The cart total reflects the manipulated price, and checkout proceeds as normal. No credentials, tokens, or user interaction beyond the request itself are required.

No verified code examples are available. See the GitHub Price Manipulation Guide for technical details on reproducing the request manipulation.

Detection Methods for CVE-2026-13571

Indicators of Compromise

Completed orders in the application database where item_price deviates from the canonical price stored in the product catalog.
HTTP POST requests to /cart.php where the item_price value is unusually low, zero, or negative.
Order totals that do not reconcile with the sum of catalog prices multiplied by quantities.

Detection Strategies

Enable verbose web server access logging for /cart.php and correlate item_price values with catalog data during nightly reconciliation.
Deploy a Web Application Firewall (WAF) rule that inspects POST parameters to /cart.php and blocks requests where item_price is submitted at all, since the value should originate server-side.
Alert on transaction anomalies such as high-value items completing checkout at negligible totals.

Monitoring Recommendations

Monitor for repeated requests to /cart.php from a single source IP that vary only in the item_price field.
Track cart-to-checkout ratios and revenue-per-order metrics for statistical outliers indicative of price tampering.
Ingest web server and application logs into a centralized platform for retrospective hunting once a compromise is suspected.

How to Mitigate CVE-2026-13571

Immediate Actions Required

Remove item_price from the list of parameters accepted by /cart.php, and instead look up the price server-side using the product identifier.
Add server-side validation that rejects any submitted price value not matching the authoritative catalog record.
Audit historical orders for prices that fall below documented catalog values and reverse fraudulent transactions where possible.

Patch Information

No official vendor patch has been published at the time of NVD listing. Operators should review the VulDB entry for CVE-2026-13571 and the SourceCodester project page for any downstream fixes. Until a maintained patch is available, apply the code-level and configuration mitigations described in this section.

Workarounds

Place the application behind a WAF configured to drop requests to /cart.php containing an item_price parameter.
Restrict access to the application to trusted networks or authenticated users while remediation is in progress.
If the deployment is non-essential, take the application offline until the pricing logic is rebuilt to source values from the server-side database.

bash

# Example WAF rule (ModSecurity) blocking client-supplied item_price on /cart.php
SecRule REQUEST_URI "@streq /cart.php" \
  "chain,phase:2,deny,status:403,id:1013571,msg:'CVE-2026-13571 price tampering attempt'"
  SecRule ARGS_NAMES "@streq item_price" "t:lowercase"