CVE-2026-10694 in Online Food Ordering System
Summary
by MITRE • 06/03/2026
A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/07/2026
This vulnerability represents a critical remote file inclusion flaw in the SourceCodester Online Food Ordering System version 2.0, specifically within the index.php file's include function. The vulnerability stems from insufficient input validation and sanitization of the page parameter, which allows attackers to manipulate the include statement and execute arbitrary file inclusion attacks. This type of vulnerability is classified as CWE-89, commonly known as SQL injection, but in this context specifically represents CWE-94, which describes improper control of generation of code, or Code Injection. The flaw exists in the application's parameter handling mechanism where user-supplied input directly influences the file inclusion process without proper validation, creating an exploitable path for remote code execution.
The technical implementation of this vulnerability occurs when an attacker crafts a malicious payload that manipulates the page parameter to include arbitrary files from the server. This typically involves supplying a path traversal sequence or direct file reference that bypasses normal access controls and file inclusion restrictions. The attack vector is particularly dangerous because it allows remote exploitation without requiring authentication, making it accessible to any attacker with network access to the vulnerable system. The exploitability is further enhanced by the fact that the vulnerability affects the core application logic in index.php, which serves as the primary entry point for user interactions. This makes the vulnerability particularly impactful as it can potentially provide attackers with complete control over the application's execution environment.
The operational impact of this vulnerability extends far beyond simple data theft or service disruption. Attackers can leverage this flaw to execute arbitrary code on the target server, potentially leading to complete system compromise, data exfiltration, and establishment of persistent backdoors. The vulnerability creates an attack surface that aligns with several tactics described in the MITRE ATT&CK framework, particularly those related to code injection and privilege escalation. The remote nature of the exploit means that attackers can target the system from anywhere on the internet, making it particularly dangerous for publicly accessible applications. Organizations running this vulnerable software face significant risk of unauthorized access, data breaches, and potential regulatory compliance violations.
Mitigation strategies should focus on immediate input validation and parameter sanitization to prevent malicious file inclusion attempts. The most effective immediate fix involves implementing strict whitelisting of acceptable page parameters, ensuring that only predefined and safe values can be passed to the include function. Additionally, the application should be updated to use secure coding practices that avoid dynamic include statements altogether, instead implementing static routing mechanisms. Network-level protections such as web application firewalls and intrusion detection systems can provide additional layers of defense against exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar issues in other components of the application. The remediation process should also include implementing proper error handling to prevent information disclosure and ensuring that the application follows secure coding guidelines as outlined in OWASP Top Ten and other industry standards. Organizations should also consider implementing network segmentation and access controls to limit the potential impact of successful exploitation attempts.