CVE-2026-127283: SourceCodester Food Ordering System Admin Image update_food.php unrestricted upload
A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/updatefood.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be performed remotely and requires no privileges or user interaction according to the supplied vector. Systems exposing the affected administrative image-handling functionality are the relevant exposure point.
What does an attacker need to target?
The issue involves manipulation of the cmd argument in admin/update_food.php within the Admin Image Handler. The provided data does not identify any additional prerequisite beyond remote access.
Is public exploit code available?
Yes. The exploit is publicly available and might be used.