Description

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-20T15:18:40.387Z",
  "pubdate": "2026-08-20T15:18:40.387Z",
  "executiveSummary": "An arbitrary file upload vulnerability has been identified within SourceCodester Simple Online Food Ordering System 1.0. Specifically, this security flaw resides in the file processing functionality accessible via the /admin/ajax.php?action=save_menu endpoint, where the manipulation of the img argument permits the upload of unrestricted files. This vulnerability exposes the affected system to remote attack vectors without requiring complex preconditions, provided the adversary can interact with the vulnerable application interface. The primary impact of this flaw includes potential remote code execution, unauthorized data modification, and complete system compromise if malicious payloads, such as web shells, are successfully uploaded and executed within the web root. Given that exploit code is publicly available, the risk implications are critical, increasing the likelihood of active exploitation by threat actors scanning for vulnerable deployments of SourceCodester Simple Online Food Ordering System 1.0.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and a lack of strict file type enforcement mechanisms within the menu management subsystem. Specifically, the processing logic handling the img parameter in /admin/ajax.php?action=save_menu fails to adequately verify the MIME type, file extension, and internal structure of uploaded files against a strict whitelist of permitted image formats. Consequently, an unauthenticated or authenticated remote attacker can manipulate the img HTTP request parameter to supply arbitrary files, including executable server-side scripts such as PHP web shells. The attack flow begins when the adversary crafts a malicious HTTP multipart request targeting /admin/ajax.php with the action parameter set to save_menu. Within this request, the img argument contains the malicious payload disguised as or replacing a legitimate image upload. Because the application fails to sanitize the input or store the uploaded file outside the web-accessible directory with a randomized filename, the server writes the malicious payload directly to the web root or a predictable subdirectory. Once the file is successfully written to the server disk, the attacker can execute the payload by directly referencing the uploaded file via an HTTP GET request, achieving arbitrary command execution under the privileges of the web server process. The affected component is the menu saving functionality within /admin/ajax.php, and the vulnerability impacts SourceCodester Simple Online Food Ordering System 1.0. Network exposure is high as the endpoint is accessible over the network, and exploitation requires no specialized privileges beyond network reachability to the vulnerable application instance, depending on administrative access controls surrounding the /admin/ directory context."
}