Simple Online Food Ordering System EUVD-2026-63391

Exploitation requires a valid administrator account on the Simple Online Food Ordering System application (CVSS PR:H confirmed). The attacker must be able to reach the /admin/ajax.php endpoint over the network (AV:N). The admin panel must be internet-exposed or accessible from the attacker's network segment. The PHP web server must serve uploaded files from a directory where PHP execution is not disabled - this is the default behavior for most shared hosting and self-hosted LAMP/LEMP stacks running this application. No user interaction is required beyond the attacker's own session. Exploitation is bounded by the admin credential requirement: without valid credentials, the endpoint is inaccessible. Non-default configurations that limit exploitation include: IP-restricted admin panels, disabled PHP execution in upload directories, or WAF rules blocking multipart uploads with PHP content to AJAX endpoints.

Real-world risk is moderate-to-high for any deployment of this specific application, but the overall exposure surface is narrow given the product's limited deployment footprint. The CVSS 4.0 score of 2.0 with VC:L/VI:L/VA:L significantly understates the realistic impact of a PHP unrestricted file upload - CWE-434 in a PHP context almost always enables arbitrary code execution and full host compromise, not merely 'low' confidentiality/integrity/availability impact. The high privilege requirement (PR:H, admin authentication) meaningfully limits the attack surface: an unauthenticated external attacker cannot exploit this directly. A public proof-of-concept exists on GitHub (referenced in the exploit advisory), which lowers the bar for exploitation once admin credentials are obtained through phishing, credential stuffing, or insider access. No KEV listing means active widespread exploitation is not confirmed. EPSS data was not provided; the combination of PR:H and niche product prevalence suggests exploitation probability is low in aggregate but high for any attacker who has already achieved admin access. The CVSS vector conflict - network-accessible but high-privilege - is internally consistent: the admin panel is reachable over the network, but a valid admin session is prerequisite.

An attacker who has obtained valid administrator credentials - through phishing, credential stuffing against the login panel, or insider access - logs into the admin panel and navigates to the menu management feature. The attacker submits a POST request to /admin/ajax.php?action=save_menu with the img parameter containing a PHP webshell file (e.g., shell.php) rather than an image; the server saves the file without validation. The attacker then directly requests the uploaded file's URL, causing the PHP interpreter to execute the webshell and return interactive OS-level command output, achieving full remote code execution on the server. A public proof-of-concept demonstrating this technique is available via the GitHub issue linked in the advisory.