The vulnerability resides in the save_product function of SourceCodester's Online Food Ordering System, allowing an attacker to alter the POST parameter price. This manipulation bypasses the intended business logic, potentially enabling negative or invalid prices that can lead to revenue loss, inventory mismanagement, or fraudulent orders. The exploit is remote and publicly available, providing an attacker the ability to send crafted requests to the web application without any special authentication or local access.

SourceCodester Online Food Ordering System, version 1.0. The issue pertains specifically to the Actions.php component handling POST parameters.

With a CVSS score of 5.3, the vulnerability presents moderate severity. No EPSS score data is available, and the issue is not listed in the CISA KEV catalog, indicating that the likelihood of widespread exploitation is uncertain. The attack vector is remote, relying on the ability to send crafted POST requests to the involved endpoint. Because the exploit code is publicly available, operational security teams should treat this as a potential risk for systems that remain unpatched or misconfigured.