The vulnerability is located in the admin/ajax.php?action=save_menu endpoint of SourceCodester’s Simple Online Food Ordering System 1.0. An attacker can manipulate the image upload argument to place arbitrary files on the server without restriction. Because the application does not validate file type or content, it permits executable or malicious files to be stored, potentially enabling remote code execution if the file is later accessed or executed.

This flaw affects the SourceCodester Simple Online Food Ordering System version 1.0 deployed on any web server where the admin interface is reachable. The official CPE indicates a single product, and the CNA notes version 1.0. No other versions or vendors are listed.

The CVSS score of 5.1 describes a medium severity flaw, while the absence of an EPSS score and lack of presence in the KEV catalog suggest the current public exploit risk is not high yet; however, the attack can be performed remotely through the exposed admin endpoint, and the publicly available exploit code means active exploitation is possible. The weaknesses identified are improper permission assignment and unrestricted file upload.