CVE-2026-1600: Bhojon Restaurant System RCE Vulnerability

CVE-2026-1600 Overview

A business logic vulnerability has been identified in Bdtask Bhojon All-In-One Restaurant Management System versions up to 20260116. The vulnerability exists in the Add-to-Cart Submission Endpoint located at /hungry/addtocart, where improper validation of the price and allprice parameters allows attackers to manipulate pricing data. This flaw enables remote attackers to potentially alter transaction values, leading to financial fraud or unauthorized discounts.

Critical Impact

Attackers can remotely manipulate cart pricing parameters to bypass intended business logic, potentially resulting in financial loss through unauthorized price modifications in the restaurant ordering system.

Affected Products

• Bdtask Bhojon All-In-One Restaurant Management System up to version 20260116

Discovery Timeline

• 2026-01-29 - CVE-2026-1600 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1600

Vulnerability Analysis

This vulnerability is classified as a Business Logic Error (CWE-840) affecting the add-to-cart functionality within the Bdtask Bhojon restaurant management platform. The flaw resides in the /hungry/addtocart endpoint, which fails to properly validate and sanitize price-related input parameters before processing cart submissions.

The vulnerability allows authenticated attackers to manipulate the price and allprice arguments during cart submission requests. Because the server-side logic trusts client-supplied pricing data without proper verification against the authoritative product database, attackers can submit modified price values that differ from the actual menu prices.

This type of business logic flaw is particularly dangerous in e-commerce and point-of-sale systems because it directly impacts financial transactions. Unlike traditional injection attacks, business logic errors exploit the intended functionality of an application by abusing assumptions made during the design phase.

Root Cause

The root cause of this vulnerability is insufficient server-side validation of pricing parameters in the add-to-cart submission workflow. The application architecture appears to trust client-supplied price values rather than retrieving authoritative pricing from the backend database during order processing. This design flaw allows users to submit arbitrary price values that the system processes without cross-referencing against legitimate product pricing.

Attack Vector

The attack can be initiated remotely by an authenticated user with low privileges. An attacker can intercept and modify HTTP requests to the /hungry/addtocart endpoint, tampering with the price or allprice parameters to submit artificially low values. The exploit has been publicly disclosed, and a proof-of-concept demonstration is available. No user interaction is required beyond the attacker initiating the malicious request.

The vulnerability mechanism involves intercepting the add-to-cart request and modifying price parameters before submission. Technical details and demonstration of this attack can be found in the GitHub PoC Discussion and the YouTube Security Presentation.

Detection Methods for CVE-2026-1600

Indicators of Compromise

• Orders with item prices significantly lower than the catalog or menu prices
• HTTP requests to /hungry/addtocart containing modified price or allprice parameter values
• Discrepancies between expected revenue and actual transaction totals
• Multiple orders from the same user or IP address with consistently underpriced items

Detection Strategies

• Implement application-layer monitoring to compare submitted prices against database values in real-time
• Deploy web application firewall (WAF) rules to flag requests where price parameters deviate from expected ranges
• Enable detailed logging for all cart and checkout operations, capturing full request payloads for forensic analysis
• Set up anomaly detection for transaction values that fall outside normal pricing boundaries

Monitoring Recommendations

• Monitor the /hungry/addtocart endpoint for unusual parameter manipulation patterns
• Implement real-time alerting for orders where calculated totals don't match submitted values
• Review daily transaction reports for pricing anomalies and investigate discrepancies promptly
• Correlate network traffic logs with application logs to identify potential exploitation attempts

How to Mitigate CVE-2026-1600

Immediate Actions Required

• Restrict access to the restaurant management system to trusted internal networks until patched
• Implement server-side price validation that retrieves pricing exclusively from the backend database
• Add input validation to reject price parameters that don't match authorized catalog values
• Review recent transaction logs for signs of exploitation and investigate anomalous orders

Patch Information

At the time of publication, the vendor (Bdtask) was contacted about this disclosure but did not respond. No official patch is currently available. Organizations using Bdtask Bhojon should monitor for vendor security updates and consider implementing compensating controls until an official fix is released. Additional vulnerability details are available through VulDB #343362.

Workarounds

• Implement a middleware or proxy layer that validates all pricing data against the authoritative database before processing
• Remove client-side price parameters from the add-to-cart request and fetch prices server-side based on product identifiers only
• Deploy rate limiting on the /hungry/addtocart endpoint to slow potential automated exploitation
• Consider temporarily disabling online ordering functionality if the risk is unacceptable and no mitigations can be applied

# Example: Add WAF rule to log suspicious price parameter modifications
# ModSecurity rule example for Apache/Nginx
SecRule ARGS:price|ARGS:allprice "@rx ^[0-9]*\.?[0-9]+$" \
    "id:100001,phase:2,log,msg:'Price parameter submitted - verify against catalog',tag:'business-logic'"

# Monitor access logs for the vulnerable endpoint
tail -f /var/log/nginx/access.log | grep "/hungry/addtocart"