Online Food Ordering System EUVD-2026-34059

Exploitation requires only that the Online Food Ordering System v2.0 application be reachable over HTTP/HTTPS and that /index.php accept the 'page' GET parameter, which is the application's default routing behavior - no authentication, no user interaction, and no non-default configuration are needed for at least local file disclosure. Escalation from file disclosure to remote code execution additionally requires PHP's allow_url_include directive to be enabled (off by default in modern PHP versions) or the presence of a writable, includable file (e.g., a log file the attacker can poison). The realistic limit on exploitation is the application's small deployment footprint rather than any technical prerequisite.

The combined signals point to a real, easily exploited bug but with bounded impact. CVSS 7.3 with AV:N/AC:L/PR:N/UI:N means remote, low-complexity, no-auth, no-interaction exploitation - the most accessible attack profile possible. The C:L/I:L/A:L scoring reflects partial impacts typical of LFI rather than full system takeover, and the vector explicitly includes E:P (proof-of-concept exploit) and RC:R (reasonable confidence). The bug is NOT on the CISA KEV list and no EPSS score was provided, so widespread mass exploitation is unconfirmed; however, given that public PoC code exists on GitHub and SourceCodester applications are frequently targeted by opportunistic scanners, defenders should treat any internet-exposed instance as high-priority. The realistic risk is constrained mainly by the niche deployment footprint of this application - it is rarely used in production enterprises, so exposure is the dominant risk factor.

An attacker discovers an internet-exposed Online Food Ordering System instance via a Shodan or Google dork search and sends a single crafted request such as GET /index.php?page=../../../../etc/passwd to read sensitive files outside the web root, including configuration files containing database credentials. With public PoC code available on GitHub, this can be automated as part of mass-scanning sweeps targeting PHP applications. If allow_url_include is enabled in php.ini, the same vector can be escalated to remote code execution by including an attacker-hosted PHP payload.