CVE-2025-6161: SourceCodester Simple Food Ordering System editproduct.php unrestricted upload
A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Harden /editproduct.php against the photo argument manipulation that leads to unrestricted upload.
SourceCodester Simple Food Ordering System photo upload handling in editproduct.php = Validate and restrict the 'photo' argument to allow only expected file types and sizes, and block any attempts that would enable unrestricted upload. - Compensating control
Restrict external (internet) access to /editproduct.php so remote users cannot reach the vulnerable endpoint.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6161?
CVE-2025-6161 is classified as a critical vulnerability.
How do I fix CVE-2025-6161?
To fix CVE-2025-6161, ensure proper validation and sanitization of file uploads in the /editproduct.php script.
What vulnerability affects the SourceCodester Simple Food Ordering System?
CVE-2025-6161 affects the SourceCodester Simple Food Ordering System due to unrestricted file upload capabilities.
Can CVE-2025-6161 be exploited remotely?
Yes, CVE-2025-6161 can be exploited remotely by manipulating the photo argument.
What impact does CVE-2025-6161 have on the system?
The impact of CVE-2025-6161 includes potential unauthorized file uploads and remote code execution.