Manipulation of the price and title parameters in order.php allows an attacker to bypass server‑side checks through client‑side enforcement. By sending modified values the attacker can submit orders with incorrect pricing or product information, leading to financial loss or data integrity compromise. This flaw is exploitable remotely and the related exploit code has already been published.

The vulnerability applies to SourceCodester Online Food Ordering System version 1.0. Any deployment using this version should be considered affected.

The flaw carries a CVSS score of 6.9, indicating moderate severity. No EPSS score is available, and the issue is not listed in CISA KEV, suggesting limited known exploitation in the wild. Attackers can trigger the vulnerability remotely by submitting crafted HTTP requests containing altered price or title values, and the weakness is classified as CWE‑602, a server‑side validation problem.