提交 #1022954: SourceCodester Online Food Ordering System in PHP and MySQL Source Code 1.0 Unrestricted File Upload Leading to Remote Code Execution

SourceCodester Online Food Ordering System in PHP and MySQL Source Code
Unrestricted File Upload Leading to Remote Code Execution

VENDOR
SourceCodester

PRODUCT
Online Food Ordering System in PHP and MySQL Source Code
Product URL: https://www.sourcecodester.com/php/18232/food-order-system.html

VULNERABILITY
An unrestricted upload may allow a file with a dangerous extension to be stored in a web-accessible directory and executed (CWE-434).

Discovered by: Shailendra Mourya (CyberShailendra)
Affected files: admin/add_food.php; similar upload checks are reported as missing in admin/update_food.php and admin/update_category.php
Report date: 2026-10-10
Status: Reported as reproduced on a local XAMPP test instance.

FINDING DETAILS

Title: Online Food Ordering System add_food.php Unrestricted File Upload RCE
Affected file: admin/add_food.php (same missing check in admin/update_food.php and admin/update_category.php)
Vulnerability type: Unrestricted Upload of File with Dangerous Type (CWE-434)
Attack vector: Network (remote); requires an authenticated admin session or may be chained with authentication bypass issues.
Authentication required: Admin (the report also notes a missing exit() in user_logged.php that may allow bypassing a redirect)
CVSS 3.1 vector (estimated): AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 score (estimated): 9.1 (Critical)
Root cause: The extension is taken directly from the uploaded filename without an allow-list or content validation. The destination images/food/ directory is web-accessible and may execute PHP files, depending on server configuration.
Proof of concept: Upload a PHP file named shell.php through the Add Food image field, then request the uploaded PHP file in images/food/.
Observed impact: The local test server reportedly returned the Windows account name through the uploaded file, indicating command execution under the web server process.
Confirmed by: Local XAMPP test instance, 2026-10-10.
Remediation: Use a strict image extension allow-list, validate the content as an image, store uploads outside the web root or disable script execution in the upload directory, and use a random filename.

TECHNICAL DETAILS — VULNERABLE CODE (admin/add_food.php)

if(isset($_FILES['image']['name']) && $_FILES['image']['name'] !=""){
$image_name = $_FILES['image']['name'];
$ext = pathinfo($image_name, PATHINFO_EXTENSION); // no allow-list check
$new_image_name = 'food_'.rand(000, 999). '.'.$ext; // extension kept as-is
$image_src = $_FILES['image']['tmp_name'];
$image_destination = '../images/food/'.$new_image_name;
$upload_image = move_uploaded_file($image_src, $image_destination);
if($upload_image == false){
echo "image failed";
die();
}
}else{
$new_image_name = "";
}

The extension is copied directly from the submitted filename, and the code does not confirm that the uploaded content is an image. The file is then placed in the web-accessible images/food/ directory. On a server configured to execute PHP there, an uploaded PHP file can run when requested.

REMEDIATION CODE

if(isset($_FILES['image']['name']) && $_FILES['image']['name'] != ""){
$image_name = $_FILES['image']['name'];
$ext = strtolower(pathinfo($image_name, PATHINFO_EXTENSION));
$allowed_ext = ['jpg', 'jpeg', 'png', 'gif', 'webp'];

// Verify that the upload is an image, not just a renamed file.
$check = @getimagesize($_FILES['image']['tmp_name']);

if(!in_array($ext, $allowed_ext) || $check === false){
$errors[] = "Only image files (jpg, jpeg, png, gif, webp) are allowed";
} else {
$new_image_name = 'food_'.uniqid().'_'.rand(1000,9999). '.'.$ext;
$image_destination = '../images/food/'.$new_image_name;
if(!move_uploaded_file($_FILES['image']['tmp_name'], $image_destination)){
$errors[] = "Image upload failed";
}
}
} else {
$errors[] = "Please select an image";
}

DEFENSE IN DEPTH

Disable PHP execution inside the images directory using an appropriate web-server configuration. For Apache, configuration may include:

php_flag engine off

Or:

<FilesMatch "\.php$">
Require all denied
</FilesMatch>

• 来源: ⚠️ https://github.com/CyberShailendra/SourceCodesterUnrestrictedFileUploadLeadingtoRemoteCode-Execution
• 用户: CyberShailendra (UID 99999)
• 提交: 2026-10-10 10時38分 (18 日前)
• 管理: 2026-10-26 17時02分 (16 days later)
• 状态: 已接受
• VulDB条目: 426509 [SourceCodester Online Food Ordering System 1.0 admin/add_food.php image 权限提升]
• 积分: 20