Simple Food Ordering System
CVE-2025-12378
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unrestricted PHP file upload with no authentication enables web shell deployment, yielding full RCE and scope change to the underlying host.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.
AnalysisAI
Unrestricted file upload in Simple Food Ordering System 1.0 (PHP) allows remote attackers to upload arbitrary files through the photo parameter of /addproduct.php, potentially enabling web shell deployment and full server compromise. The affected product is tracked under CPE cpe:2.3:a:fabian:simple_food_ordering_system:1.0, and exploit code is publicly available via GitHub. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.06% (17th percentile), though the presence of a public proof-of-concept combined with an authentication bypass tag elevates realistic risk above what the low EPSS would suggest.
Technical ContextAI
The vulnerability exists in /addproduct.php, a PHP script within this hobbyist food ordering application that processes product image uploads via the photo parameter. The root cause maps to CWE-284 (Improper Access Control) - the application fails to enforce proper access restrictions on the upload endpoint, allowing unauthenticated or improperly authorized users to supply arbitrary file content. Tags identify this as both a file upload and authentication bypass issue, suggesting /addproduct.php may be intended as an admin-only function but is reachable without proper authentication enforcement. In a standard PHP web application, unrestricted file upload to a web-accessible directory enables an attacker to place a PHP web shell, converting a file-write primitive into remote code execution under the web server process context.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project is sourced from code-projects.org, a hobbyist/demo code repository with no formal security response process. As a primary compensating control, remove or restrict access to /addproduct.php entirely via web server configuration (e.g., Apache .htaccess deny rules or nginx location blocks) to prevent unauthenticated access. If the upload feature must remain available, implement strict server-side file type validation using allowlist logic (accept only MIME types such as image/jpeg, image/png, and image/gif), enforce file extension filtering, and store uploaded files outside the web root or rename them to strip executable extensions - this prevents uploaded PHP content from being executed by the web server. Additionally, configure the web server to deny PHP execution within the upload directory (e.g., PHP engine off in Apache per-directory config). Given this is demo/educational software, the highest-confidence remediation is to not deploy this application in any internet-accessible or production environment. The public PoC is referenced at https://github.com/tinggeogle01-lang/cve/issues/1.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today