CVE-2026-1600

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1600", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-29T08:44:44.234Z", "datePublished": "2026-01-29T18:02:06.201Z", "dateUpdated": "2026-02-23T09:06:22.910Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:06:22.910Z"}, "title": "Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-840", "lang": "en", "description": "Business Logic Errors"}]}], "affected": [{"vendor": "Bdtask", "product": "Bhojon All-In-One Restaurant Management System", "versions": [{"version": "20260116", "status": "affected"}], "modules": ["Add-to-Cart Submission Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-29T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-29T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-30T04:59:41.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "4m3rr0r (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.343362", "name": "VDB-343362 | Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343362", "name": "VDB-343362 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.740741", "name": "Submit #740741 | Bdtask Bhojon All-In-One Restaurant Management System latest Business Logic Errors", "tags": ["third-party-advisory"]}, {"url": "https://github.com/4m3rr0r/PoCVulDb/issues/14", "tags": ["exploit", "issue-tracking"]}, {"url": "https://www.youtube.com/watch?v=UESZTjVS4Fs", "tags": ["exploit", "media-coverage"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T21:14:55.728380Z", "id": "CVE-2026-1600", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:15:13.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1600", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T21:14:55.728380Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:15:03.975Z"}}], "cna": {"title": "Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error", "credits": [{"lang": "en", "type": "reporter", "value": "4m3rr0r (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "Bdtask", "modules": ["Add-to-Cart Submission Endpoint"], "product": "Bhojon All-In-One Restaurant Management System", "versions": [{"status": "affected", "version": "20260116"}]}], "timeline": [{"lang": "en", "time": "2026-01-29T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-29T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-30T04:59:41.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.343362", "name": "VDB-343362 | Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.343362", "name": "VDB-343362 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.740741", "name": "Submit #740741 | Bdtask Bhojon All-In-One Restaurant Management System latest Business Logic Errors", "tags": ["third-party-advisory"]}, {"url": "https://github.com/4m3rr0r/PoCVulDb/issues/14", "tags": ["exploit", "issue-tracking"]}, {"url": "https://www.youtube.com/watch?v=UESZTjVS4Fs", "tags": ["exploit", "media-coverage"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-840", "description": "Business Logic Errors"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:06:22.910Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1600", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:06:22.910Z", "dateReserved": "2026-01-29T08:44:44.234Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-29T18:02:06.201Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Add-to-Cart Submission Endpoint"], "product": "Bhojon All-In-One Restaurant Management System", "vendor": "Bdtask", "versions": [{"status": "affected", "version": "20260116"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bdtask:bhojon:*:*:*:*:*:*:*:*", "matchCriteriaId": "CEAEEF25-6D2D-421C-9F85-0FA09FA60717", "versionEndIncluding": "2026-01-16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en el sistema de gesti\u00f3n de restaurantes todo en uno Bdtask Bhojon hasta el 20260116. El elemento afectado es una funci\u00f3n desconocida del archivo /hungry/addtocart del componente Add-to-Cart Submission Endpoint. La manipulaci\u00f3n del argumento price/allprice conduce a errores de l\u00f3gica de negocio. El ataque puede iniciarse de forma remota. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-1600", "lastModified": "2026-06-17T10:16:08.753", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1600", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T21:14:55.728380Z", "version": "2.0.3"}}]}, "published": "2026-01-29T18:16:14.773", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Mitigation"], "url": "https://github.com/4m3rr0r/PoCVulDb/issues/14"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.343362"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.343362"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.740741"}, {"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://www.youtube.com/watch?v=UESZTjVS4Fs"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-840"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:23:31.682306+00:00", "value": {"mitigation_remediation": ["Ensure that price and allprice values are validated and calculated server\u2011side, rejecting any client\u2011supplied price adjustments that do not match database records or business rules.", "Upgrade the Bhojon All\u2011In\u2011One Restaurant Management System to a version released after 20260116 once an official patch becomes available.", "If a patch is not yet available, temporarily disable or remove the ability for users to supply price parameters in the add\u2011to\u2011cart request, and enforce calculation of pricing exclusively on the server."], "summary": {"action": "Assess Impact", "impact": "Business Logic Manipulation leading to incorrect pricing and potential financial loss"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts Bdtask's Bhojon All\u2011In\u2011One Restaurant Management System in all releases up to and including 20260116. No later versions have been confirmed to contain the flaw, but users should verify that they are running a version released after this date.", "description_and_impact": "A flaw in the /hungry/addtocart endpoint of Bdtask's Bhojon All\u2011In\u2011One Restaurant Management System allows attackers to manipulate the \"price\" and \"allprice\" arguments, causing the server to accept out\u2011of\u2011range or falsified pricing. The backend logic trusts these client\u2011supplied values without adequate server\u2011side validation, which can result in improper billing, fraudulent orders, and loss of revenue. This defect is categorized as CWE\u2011840, a business\u2011logic error that stems from incorrect assumption about trusted data.", "risk_and_exploitability": "The CVSS base score is 5.3, indicating moderate severity, while the EPSS score is below 1\u202f%, reflecting a low yet non\u2011zero likelihood of exploitation. The flaw is not listed in CISA's KEV catalog. Attackers can exploit it remotely by submitting crafted add\u2011to\u2011cart requests that alter price values, thereby bypassing intended pricing rules and potentially generating incorrect charges. Because the issue primarily affects business logic and financial accuracy rather than enabling code execution or denial of service, its impact depends on the system\u2019s reliance on accurate billing and customer trust."}}}}, "created": "2026-01-30T08:42:43.355710+00:00", "updated": "2026-04-18T01:30:16.039914+00:00", "vendors": ["bdtask", "bdtask$PRODUCT$bhojon"]}