CVE-2026-116602 in Online Food Ordering System
Summary
by MITRE • 10/27/2026
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The SourceCodester Online Food Ordering System version 1.0 contains a critical security flaw within its administrative interface, specifically located in the delete.php file at line involving the unlink function. This vulnerability stems from an improper validation of user-supplied input passed via the image_name parameter. When an administrator or any authenticated user interacts with this endpoint to remove food images, the system fails to sanitize the filename before passing it directly to PHP's unlink function. This lack of rigorous input validation allows for a path traversal attack, where an attacker can manipulate the file path argument to reference files outside the intended directory structure. By injecting sequences such as dot-dot-slash followed by relative paths or absolute paths pointing to sensitive system files, an adversary can trick the server into deleting arbitrary files on the underlying operating system.
This vulnerability is classified under CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-73 External Control of File Name or Path. The technical mechanism relies on the fact that PHP's unlink function will delete any file for which the executing user has write permissions, regardless of whether it resides in the expected upload directory. Since this is an administrative feature, the web server process typically runs with elevated privileges relative to public-facing directories, increasing the potential blast radius of a successful exploitation attempt. The flaw represents a classic example of insecure direct object reference combined with path traversal, where trust is placed in user-controlled variables without adequate boundary checks or canonicalization processes to ensure the target file remains within the allowed scope.
The operational impact of this vulnerability extends beyond simple data loss regarding food images. An attacker who successfully exploits this remote code execution vector can delete critical configuration files, database connection scripts, or even system-level binaries if permissions allow. This could lead to a complete denial of service by disrupting the application's functionality or causing significant downtime for the business operations relying on the ordering system. Furthermore, in more complex scenarios involving specific server configurations, deleting certain files might expose other vulnerabilities or facilitate further attacks such as remote code execution through file inclusion techniques if combined with other weaknesses like local file inclusion. The availability of public exploits means that automated scanners and malicious actors can readily identify and leverage this weakness against unpatched instances deployed on the internet.
Mitigation strategies must focus on implementing strict input validation and secure coding practices within the delete.php script. Developers should enforce a whitelist approach for allowed filenames, ensuring they match expected patterns such as alphanumeric characters with specific extensions like jpg or png. Additionally, using PHP's realpath function to resolve the canonical path of both the intended directory and the user-supplied filename can help verify that the target file actually resides within the permitted directory before deletion occurs. It is also crucial to apply the principle of least privilege by ensuring the web server process does not have unnecessary write access to directories outside its designated scope. Regular security audits, static code analysis tools configured to detect path traversal risks, and keeping all third-party components updated are essential steps in maintaining a secure environment against such exploitation attempts aligned with MITRE ATT&CK techniques related to resource hijacking or impact actions like data destruction.