CVE-2026-10694: SourceCodester Online Food Ordering System index.php include file inclusion
A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove the affected component from your environment.
If the vulnerable dynamic include feature is not required, remove or disable the code that performs the include in /index.php. If the entire application instance is not needed, consider uninstalling or taking it offline.
- Configuration
Stop directly including files based on the user-supplied 'page' parameter. Replace dynamic include logic with a server-side whitelist or explicit routing: map allowed 'page' values to fixed internal files and reject or fallback to a safe default for all other values. Validate and sanitize the parameter to allow only expected tokens (no path separators, no URLs).
SourceCodester Online Food Ordering System index.php include (page parameter) = whitelist-only / validated values - Configuration
Enforce use of fixed, internal paths for includes and prevent directory traversal or remote file inclusion by normalizing and validating any path-like input and refusing inputs that contain '../', protocol schemes, or other unexpected characters.
SourceCodester Online Food Ordering System file inclusion behavior = disallow user-controlled paths - Compensating control
Deploy compensating controls while code fixes are applied: add WAF rules or web server filters to block attempts to supply malicious 'page' parameter values (e.g., patterns with '../', 'http://' or 'https://', or null byte attempts), and restrict access to the application to trusted networks or IPs.
- Operational
Assume exploitation may have occurred: review web server and application logs for attempts to exploit the include parameter, scan the filesystem for unauthorized uploaded files or web shells, and perform incident response steps (containment, further investigation). Rotate any credentials or keys if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10694?
The severity of CVE-2026-10694 is high with a CVSS score of 7.3.
How do I fix CVE-2026-10694?
To fix CVE-2026-10694, you should update to the latest version of the SourceCodester Online Food Ordering System that addresses this vulnerability.
What is the impact of CVE-2026-10694?
CVE-2026-10694 allows attackers to perform remote file inclusion through the manipulation of the 'page' parameter in the /index.php file.
Can CVE-2026-10694 be exploited remotely?
Yes, CVE-2026-10694 can be exploited remotely.
Is the exploit for CVE-2026-10694 publicly available?
Yes, the exploit for CVE-2026-10694 is now public and may be used by attackers.