Vulnerability · Published Jan 29, 2026 · Assigned by VulDB

CVE-2026-1599Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error

Medium 4.3

In plain English

A medium-severity security flaw in Bhojon All-In-One Restaurant Management System from Bdtask. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 74.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder of the component Checkout. Executing a manipulation of the argument orggrandTotal/vat/service_charge/grandtotal can lead to business logic errors. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Bdtask	Bhojon All-In-One Restaurant Management System	20260116

Weakness: CWE-840 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-343361 | Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error vdb-entry, technical-description
VDB-343361 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #740740 | Bdtask Bhojon All-In-One Restaurant Management System latest Business Logic Errors third-party-advisory
https://github.com/4m3rr0r/PoCVulDb/issues/13 exploit, issue-tracking
https://www.youtube.com/watch?v=n7xLBAOrKAU exploit, media-coverage