The vulnerability CVE-2026-1600 affects the Bdtask Bhojon All-In-One Restaurant Management System, specifically versions up to 20260116. The issue resides in an unspecified function within the /hungry/addtocart endpoint, which handles the submission of items to a customer's cart. Attackers can manipulate the 'price' or 'allprice' parameters, causing business logic errors. These errors likely allow unauthorized modification of order prices, enabling attackers to reduce prices or alter totals in ways not intended by the system's design. The vulnerability is remotely exploitable without requiring authentication or user interaction, increasing its risk profile. The CVSS 4.0 score is 5.3 (medium), reflecting the moderate impact on integrity and limited impact on confidentiality and availability. The vendor was contacted but did not respond, and no patches or fixes have been published. The exploit code is publicly available, increasing the likelihood of exploitation. The vulnerability does not require privileges or user interaction, making it easier to exploit in automated attacks. The lack of vendor response and patch availability means affected organizations must rely on mitigation strategies until an official fix is released.

For European organizations, particularly those in the hospitality and restaurant sectors using the Bhojon All-In-One system, this vulnerability could lead to financial losses due to manipulated pricing in orders. Attackers could exploit the flaw to reduce prices or create fraudulent orders, impacting revenue and potentially causing accounting discrepancies. Additionally, business process integrity is compromised, which could disrupt order fulfillment and customer trust. While the vulnerability does not directly affect confidentiality or availability, the integrity impact on transactional data is significant. Given the remote exploitability and public availability of exploit code, there is an increased risk of automated or targeted attacks. Organizations may also face reputational damage if customers experience pricing errors or fraudulent transactions. The lack of vendor response and patch availability increases the window of exposure, making timely mitigation critical.

Since no official patch is available, European organizations should implement compensating controls immediately. These include: 1) Implement server-side validation and verification of all price-related parameters to ensure they match expected values and cannot be manipulated by clients. 2) Introduce strict input sanitization and parameter validation on the /hungry/addtocart endpoint to reject malformed or suspicious requests. 3) Monitor transaction logs for anomalies in pricing or order totals that deviate from normal patterns, enabling early detection of exploitation attempts. 4) Restrict access to the add-to-cart endpoint using network-level controls such as IP whitelisting or web application firewalls (WAFs) with custom rules to detect and block suspicious parameter manipulation. 5) Employ rate limiting to reduce the risk of automated exploitation. 6) Prepare incident response plans to quickly address detected exploitation. 7) Engage with the vendor or community to track any forthcoming patches or updates. 8) Consider alternative software solutions if the vendor remains unresponsive and the risk is unacceptable.