vendor:
Online Food Ordering System
by:
Eren Şimşek
9.8
CVSS
HIGH
Remote Code Execution
434
CWE
Product Name: Online Food Ordering System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:online_food_ordering_system:1.0
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows/Linux - XAMPP Server
2020
Online Food Ordering System 1.0 – Remote Code Execution
A vulnerability exists in the Online Food Ordering System 1.0, which allows an attacker to execute arbitrary code on the target system. This is due to the lack of proper input validation in the 'save_menu' action of the 'ajax.php' script, which allows an attacker to upload a malicious PHP file to the 'images/menu' directory. This can be exploited to execute arbitrary code on the target system by sending a specially crafted HTTP request containing the malicious PHP file.
Mitigation:
Input validation should be implemented to prevent malicious files from being uploaded.
