A flaw in the /hungry/addtocart endpoint of Bdtask's Bhojon All‑In‑One Restaurant Management System allows attackers to manipulate the "price" and "allprice" arguments, causing the server to accept out‑of‑range or falsified pricing. The backend logic trusts these client‑supplied values without adequate server‑side validation, which can result in improper billing, fraudulent orders, and loss of revenue. This defect is categorized as CWE‑840, a business‑logic error that stems from incorrect assumption about trusted data.

The vulnerability impacts Bdtask's Bhojon All‑In‑One Restaurant Management System in all releases up to and including 20260116. No later versions have been confirmed to contain the flaw, but users should verify that they are running a version released after this date.

The CVSS base score is 5.3, indicating moderate severity, while the EPSS score is below 1 %, reflecting a low yet non‑zero likelihood of exploitation. The flaw is not listed in CISA's KEV catalog. Attackers can exploit it remotely by submitting crafted add‑to‑cart requests that alter price values, thereby bypassing intended pricing rules and potentially generating incorrect charges. Because the issue primarily affects business logic and financial accuracy rather than enabling code execution or denial of service, its impact depends on the system’s reliance on accurate billing and customer trust.