CVE-2026-1600: Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error
A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1600?
CVE-2026-1600 is classified as a critical vulnerability due to its potential impact on the application's add-to-cart functionality.
How do I fix CVE-2026-1600?
To fix CVE-2026-1600, ensure you update the Bdtask Bhojon All-In-One Restaurant Management System to a version later than 20260116.
What exploitation possibilities exist with CVE-2026-1600?
CVE-2026-1600 could allow an attacker to manipulate the add-to-cart functionality, potentially leading to unauthorized transactions.
Is my version of Bdtask Bhojon at risk with CVE-2026-1600?
If you are using Bdtask Bhojon All-In-One Restaurant Management System version 20260116 or earlier, you are at risk from CVE-2026-1600.
What component is affected by CVE-2026-1600?
CVE-2026-1600 specifically affects the addtocart logic in the /hungry/addtocart endpoint of the application.