Simple Food Ordering System CVE-2025-12378

The attack requires that /addproduct.php be reachable over the network without enforced authentication - the authentication bypass tag indicates this admin-facing endpoint lacks proper access control. No victim interaction is needed. Exploitation is additionally conditional on the web server storing uploaded files in a web-accessible directory and not stripping or blocking PHP file extensions at the server level. Factors that limit exploitation: the product has an extremely small real-world deployment footprint (hobbyist/demo code); server-side PHP execution restrictions in the upload directory would neutralize web shell deployment even if a file is uploaded; and standard web application firewalls with file upload rules may block the malicious payload.

The official CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) assigns only low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding a 5.5 score - which appears notably conservative for an unrestricted file upload flaw in a PHP application. If the upload destination is web-accessible, the realistic impact is full remote code execution, warranting much higher severity. EPSS of 0.06% at the 17th percentile suggests low opportunistic scanning activity, but this is likely due to the niche deployment footprint of the product rather than absence of exploitability. The E:P (proof-of-concept) threat modifier in the provided CVSS 4.0 vector is confirmed by a public GitHub PoC. Not listed in CISA KEV, so confirmed mass exploitation is not established. The key discrepancy: CVSS 4.0 impact is rated low, but standard analysis of unrestricted PHP file upload suggests integrity and confidentiality impact should be rated high - defenders should independently verify whether the upload directory is web-accessible when scoping remediation priority.

An unauthenticated remote attacker sends a multipart HTTP POST request to /addproduct.php with the photo parameter containing a PHP web shell file (e.g., shell.php with <?php system($_GET['cmd']); ?>). If the server stores the upload in a web-accessible directory without extension filtering, the attacker then browses to the uploaded file's URL and appends a command parameter to execute arbitrary OS commands as the web server user. A public proof-of-concept demonstrating this technique is available on GitHub.