Simple Food Ordering System
CVE-2025-12301
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:N reflects confirmed auth bypass; I:H because unrestricted PHP upload enables arbitrary file write with likely execution capability; C:L and A:L are conservative absent confirmed post-upload impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
AnalysisAI
Unrestricted file upload in code-projects Simple Food Ordering System 1.0 allows remote attackers to upload arbitrary files through the photo parameter of /editproduct.php, exploiting improper access control (CWE-284) that effectively bypasses authentication on the upload endpoint. The Authentication Bypass tag alongside CWE-284 signals that the product-editing endpoint - which should be access-controlled - can be reached without valid credentials, enabling file placement on the server. A public proof-of-concept is disclosed on GitHub; EPSS sits at 0.06% (17th percentile), indicating minimal observed exploitation at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Technical ContextAI
The affected product is identified by CPE cpe:2.3:a:fabian:simple_food_ordering_system:1.0:*:*:*:*:*:*:* - a PHP-based web application distributed via code-projects.org, targeting small-scale or educational food ordering deployments. The vulnerable endpoint /editproduct.php accepts a photo argument intended for product image upload but fails to enforce file-type restrictions or adequate access control. CWE-284 (Improper Access Control) is the root cause class: the application does not correctly verify whether the requesting user is authorized to invoke the upload functionality, meaning the endpoint is reachable without authentication. Because the application is PHP-based and the upload target is likely within the web root, successfully uploaded PHP scripts may be directly executable by the web server process, elevating a file-write primitive to potential remote code execution.
RemediationAI
No vendor-released patch has been identified at time of analysis; the references do not include a patched release or upstream commit. Given the absence of an official fix, the primary compensating control is to take the application offline or restrict access to the /editproduct.php endpoint via web server configuration (e.g., deny access by IP allowlist or HTTP authentication layer at the server level - note this adds friction for legitimate admins). If continued use is required, implement server-side file-type validation (whitelist image MIME types and extensions, reject PHP/executable extensions) and move the upload directory outside the web root to prevent direct execution of uploaded files - these are code-level mitigations requiring developer intervention. Restrict upload directory permissions so the web server process cannot execute files within it. Monitor the upload directory for non-image files as a detection measure. Refer to VulDB advisory https://vuldb.com/?id.329973 and the POC at https://github.com/underatted/CVE/issues/22 for technical details.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today