A Cross-Site Request Forgery vulnerability in the Restajet Online Food Delivery System, rated as High severity, poses a significant risk of unauthorized state changes within the application.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability specifically requires the attacker to trick an authenticated user into interacting with a malicious request, leveraging the application's lack of proper CSRF protection.

The exploitation of this flaw could allow unauthorized actors to perform sensitive operations within the application without the user's consent. Given the CVSS score of 7.1, this vulnerability presents a significant risk to data integrity and operational security. Organizations relying on this software may face unauthorized account modifications or data manipulation, potentially leading to operational disruption or loss of trust.

Immediate Action: Since no official patch is currently available from the vendor, administrators should restrict access to the application and monitor for suspicious traffic patterns.

Proactive Monitoring: Review application access logs for unusual request patterns, specifically those originating from unexpected referrers or occurring without clear user intent.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block requests that lack proper anti-CSRF tokens or originate from untrusted sources.

Public Exploit Available: Unknown.

Due to the lack of vendor response and the potential for unauthorized actions, users are strongly advised to implement strict network-level access controls. Organizations should prioritize migrating to a more secure platform or isolating the affected system from public-facing networks until a formal security update or patch is released.