| Title | katojkalemba Online Food Ordering System 1.0 Unrestricted Upload |
|---|
| Description | A vulnerability was found in katojkalemba Online Food Ordering System 1.0. It has been declared as critical. This vulnerability affects the file /admin/add_food.php. The image parameter is processed by taking the client-supplied filename extension via pathinfo() and storing the upload as food_<rand(0,999)>.<ext> in the web-accessible directory /images/food/ (lines 15-30). No extension whitelist, MIME check or content validation exists, and the upload is performed before any other input validation. Combined with the broken access control in /admin/partials/user_logged.php, an unauthenticated remote attacker can upload a PHP web shell. The random filename space is only 1000 values and can be brute-forced within minutes, after which arbitrary operating system commands execute with web server privileges. This was verified in a local deployment where an uploaded shell.php executed id as uid=0 (root in the container). The attack may be initiated remotely. No form of authentication is needed for exploitation. The vendor was contacted via the SourceCodester project page and did not respond. |
|---|
| Source | ⚠️ https://github.com/LINJUNGZHU/CVE-Online-Food-Ordering-System/issues/2 |
|---|
| User | LinJ (UID 102009) |
|---|
| Submission | 10/11/2026 17:55 (16 days ago) |
|---|
| Moderation | 10/27/2026 10:25 (16 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 426509 [SourceCodester Online Food Ordering System 1.0 admin/add_food.php image unrestricted upload] |
|---|
| Points | 0 |
|---|