Description
A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-10-26
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw exists in the admin/add_food.php script of SourceCodester Online Food Ordering System that allows an attacker to upload any file type through the image parameter. This unrestricted upload can be leveraged to place executable code on the server, enabling remote code execution. The weakness falls under unauthorized access and uncontrolled file upload, making it possible for an attacker to compromise the system’s integrity and confidentiality.

Affected Systems

The affected vendor is SourceCodester and the product is Online Food Ordering System, version 1.0. The vulnerability is present in the admin/add_food.php endpoint and is applicable to deployments that have not updated or patched the system.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score is not available, implying no publicly reported exploitation frequency data. The vulnerability is not listed in the CISA KEV catalog, but an exploit has been published and may be used remotely. Attackers would need to reach the admin interface, potentially bypassing authentication, to manipulate the image argument and upload malicious files. Successful exploitation would grant code execution on the server.

Generated by OpenCVE AI on October 27, 2026 at 06:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Disable or remove the admin/add_food.php endpoint until a secure upload mechanism is deployed.
  • Implement strict file type validation by checking MIME types and extensions, rejecting any files that do not match an allowed whitelist.
  • Store uploaded files outside the web‑accessible directory and set restrictive permissions to prevent their execution.

Generated by OpenCVE AI on October 27, 2026 at 06:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
Title SourceCodester Online Food Ordering System add_food.php unrestricted upload
First Time appeared Sourcecodester
Sourcecodester online Food Ordering System
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:sourcecodester:online_food_ordering_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Food Ordering System
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Food Ordering System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T23:30:13.680Z

Reserved: 2026-10-26T16:02:27.014Z

Link: CVE-2026-116603

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T00:17:10.460

Modified: 2026-10-27T00:17:10.460

Link: CVE-2026-116603

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T06:45:06Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type