提交 #1022943: SourceCodester Online Food Ordering System in PHP and MySQL Source Code 1.0 File Deletion via Path Traversal

sourcecodester Online Food Ordering System in PHP and MySQL Source Code
Arbitrary File Deletion via Path Traversal

VENDOR
SourceCodester

PRODUCT
Online Food Ordering System in PHP and MySQL Source Code
Product URL: https://www.sourcecodester.com/php/18232/food-order-system.html

VULNERABILITY
Path traversal in admin/delete.php can allow arbitrary file deletion (CWE-22 / CWE-73).

Discovered by: Shailendra Mourya (CyberShailendra)
Affected files: admin/delete.php; similar patterns are reported in admin/delete_category.php, admin/update_food.php, and admin/update_category.php
Report date: 2026-10-10
Status: Reported as reproduced on a local XAMPP test instance.

FINDING DETAILS

Title: Online Food Ordering System delete.php Path Traversal Arbitrary File Deletion
Affected file: admin/delete.php (similar pattern present in admin/delete_category.php, admin/update_food.php, admin/update_category.php)
Vulnerability type: Path Traversal (CWE-22) leading to Arbitrary File Deletion (CWE-73)
Attack vector: Network (remote)
Authentication required: None (see VDB-NC-003 — delete scripts have no login check)
CVSS 3.1 vector (estimated): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 score (estimated): 7.5 (High)
Root cause: The value of $_GET['image_name'] is concatenated directly into a filesystem path and passed to unlink() without sanitization.
Proof of concept: GET /web/admin/delete.php?id=1&image_name=../../config/constants.php
Observed impact: config/constants.php was deleted on the test instance, causing application pages that include header.php to fail with an include warning.
Confirmed by: Local XAMPP test instance, 2026-10-10; file deletion was verified through PHP include warnings.
Remediation: Apply basename() to the supplied filename and verify with realpath() that the resolved path remains inside the intended upload directory before calling unlink().

TECHNICAL DETAILS — VULNERABLE CODE (admin/delete.php)

<?php
include('../config/constants.php');
if(isset($_GET['id']) && isset($_GET['image_name'])){
$id = intval($_GET['id']);
$image = $_GET['image_name']; // raw, attacker-controlled

if(!empty($image) && file_exists('../images/food/'.$image)){
unlink('../images/food/'.$image); // traversal reaches files outside the directory
}

$sql = "delete from tbl_food where id=$id";
$res = mysqli_query($conn, $sql);
if($res == true){
$_SESSION['delete_food'] = "food deleted successfully";
header('Location:'.SITEURL.'admin/food.php');
}
}else{
header('Location:'.SITEURL.'admin/food.php');
}
?>

The application does not validate $image before using it. A path such as ../../config/constants.php can resolve outside images/food/, allowing unlink() to target an application file.

REMEDIATION CODE

<?php
include('../config/constants.php');
include('user_logged.php'); // also addresses VDB-NC-003 for this endpoint

if(isset($_GET['id']) && isset($_GET['image_name'])){
$id = intval($_GET['id']);
$image = basename($_GET['image_name']); // strips path components

$upload_dir = realpath('../images/food');
$target = realpath($upload_dir . '/' . $image);

// Only unlink if the resolved path remains inside the upload directory.
if(!empty($image) && $target !== false && strpos($target, $upload_dir) === 0 && is_file($target)){
unlink($target);
}

$sql = "delete from tbl_food where id=?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
$res = mysqli_stmt_execute($stmt);

if($res){
$_SESSION['delete_food'] = "food deleted successfully";
header('Location:'.SITEURL.'admin/food.php');
exit();
}
}else{
header('Location:'.SITEURL.'admin/food.php');
exit();
}
?>

• 来源: ⚠️ https://github.com/CyberShailendra/sourcecodesterArbitraryFileDeletion-via-PathTraversal
• 用户: CyberShailendra (UID 99999)
• 提交: 2026-10-10 10時28分 (17 日前)
• 管理: 2026-10-26 17時02分 (16 days later)
• 状态: 已接受
• VulDB条目: 426508 [SourceCodester Online Food Ordering System 1.0 admin/delete.php unlink image_name 目录遍历]
• 积分: 20