Food Ordering System CVE-2026-116603

Requires authenticated administrator access to the application's admin interface, specifically the add_food.php food-management function where the 'image' upload field is processed without proper file-type/content validation. The limiting factors are significant: PR:H means a valid admin session is mandatory (not an anonymous or low-privilege user), and exploitation depends on reaching the admin panel over the network. This is not remote-unauthenticated; the admin-only precondition sharply narrows realistic attackers to those who have already compromised or legitimately hold administrative credentials.

Signals converge on LOW real-world priority. The supplied CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:N, VC:L/VI:L/VA:L) yields a base score of only 2.0, driven down by PR:H - exploitation requires high privileges (an authenticated administrator), since the vulnerable function lives in admin/add_food.php. EPSS is 0.29% (22nd percentile), indicating low predicted exploitation activity, and the vuln.today Decision label is 'monitor' rather than act_now/emergency. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (a GitHub repository), but it is not verified as working exploit code. Note a tension between the metadata and the referenced PoC: the input vector rates impact as Low across the board (VC/VI/VA:L), yet the referenced GitHub project is titled as unrestricted file upload leading to remote code execution - if a PHP webshell can be uploaded, the true technical impact would be far higher than the 2.0 score suggests. However, because the flaw is reachable only by an already-privileged admin, an attacker at that level typically already controls the application, which explains the low scoring. Net: low priority given the admin-only precondition, obscure product, and absence of confirmed exploitation.

An attacker who already holds administrator credentials to the Online Food Ordering System admin panel submits the add_food.php form and manipulates the 'image' upload argument to supply a malicious PHP file instead of an image. Because the upload is unrestricted (CWE-434), the file is stored in a web-accessible location and can then be requested to execute attacker code on the server. A public PoC reference exists but is not verified as working exploit code; exploitation requires network reach to the admin interface plus valid admin privileges (PR:H).