{"id":"CVE-2026-127283","kind":"vulnerability","aliases":["CVE-2026-127283"],"related":[],"title":"SourceCodester Food Ordering System: admin image handler allows unrestricted remote file upload","description":"A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.","summary":"Admin food update handler admin/update_food.php in SourceCodester Online Food Ordering System 1.0 accepts uploaded files without restricting type. A public Packet Storm write-up describes uploading a PHP file for remote code execution, and says the attacker must be an authenticated admin. No vendor patch is known.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SourceCodester Food Ordering System","fixed":[],"affected":"1.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-upload","food-ordering-system","other","php","self-hosted","sourcecodester"],"not_affected_if":["admin-not-exposed","auth-required"],"how_to_check":"- Look for admin/update_food.php in the web root of the PHP app (SourceCodester Online Food Ordering System 1.0).\n- Check the upload directory used for food images for .php or other script files you did not put there.\n- Version: the code is distributed as 1.0 with no version string in the sources; if you installed this download, assume 1.0.\n- Also check admin/add_food.php and admin/update_category.php: a VulDB submission reports similar missing upload checks there (separate CVE-2026-116603 covers add_food.php).","fix":"No vendor fix or patched version found in the sources. Mitigate: restrict /admin/ to trusted IPs or put it behind extra authentication, allow only image extensions and MIME types, store uploads outside the web root, and disable PHP execution in the upload directory.","status":"open","published_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","triaged_at":"2026-11-13T02:42:57+00:00","updated_at":"2026-11-13T02:45:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T02:42:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SourceCodester Food Ordering System: admin image handler allows unrestricted remote file upload","impact":"high","summary":"The admin image handler in SourceCodester Food Ordering System 1.0 (admin/update_food.php) lets a remote user upload files through the cmd argument without restriction. A public exploit exists, so an attacker could place a file such as a web shell on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","food-ordering-system","sourcecodester"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker uploads files and may run code on the server","analyst_note":"Confirm whether authentication is required for admin/update_food.php and whether any fixed version or vendor patch exists; check the NVD entry and the public exploit references.","how_to_check":"- Check whether the application is installed: look for admin/update_food.php in the web root.\n- Confirm the version: unknown; the sources do not say how to read it.","plain_action":"","product_name":"SourceCodester Food Ordering System","needs_analyst":true,"not_affected_if":["admin-not-exposed"],"who_is_affected":"Any server running SourceCodester Food Ordering System 1.0 with its admin panel reachable from the network is exposed, since the admin image handler is reachable remotely. Installations where the admin area is not reachable from outside, or that run a different version, are not described by the sources. Whether authentication is required is not stated.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000744,"input_tokens":4557,"output_tokens":576,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether authentication is required for admin/update_food.php and whether any fixed version or vendor patch exists; check the NVD entry and the public exploit references.","search":"'-127283':15A,18A '-2026':14A,17A '1.0':47B,93C 'accept':48B 'admin':5A,36B,78B,109C 'admin/update_food.php':40B,105C 'affect':94C 'allow':8A 'argument':116C 'attack':73B,123C 'authent':77B 'avail':133C 'cmd':117C 'code':68B 'compon':108C 'cve':13A,16A 'describ':61B 'execut':69B 'exploit':130C 'file':11A,24B,50B,65B,104C 'file-upload':23B 'food':2A,20A,27B,37B,44B,90C 'food-ordering-system':26B 'function':101C 'handler':7A,39B,111C 'host':34B 'identifi':87C 'imag':6A,110C 'issu':97C 'known':83B 'lead':118C 'manipul':113C 'may':124C 'might':135C 'must':74B 'onlin':43B 'order':3A,28B,45B,91C 'ordering':21A 'packet':56B 'patch':81B 'perform':126C 'php':31B,64B 'public':55B,132C 'remot':10A,67B,128C 'restrict':52B 'say':71B 'self':33B 'self-host':32B 'sourcecodest':1A,35B,42B,89C 'sourcecodester':19A 'storm':57B 'system':4A,22A,29B,46B,92C 'type':53B 'unknown':100C 'unrestrict':9A,120C 'updat':38B 'upload':12A,25B,49B,62B,121C 'use':137C 'vendor':80B 'vulner':85C 'without':51B 'write':59B 'write-up':58B","nicknames":[],"mitigations":[],"who_affected":"Anyone running SourceCodester Online Food Ordering System 1.0, a sample PHP app, with the admin area reachable. The public PoC describes it as needing an authenticated admin login, though the CVE's CVSS vector says no privileges are needed, so treat it as possibly unauthenticated. Can skip if the app isn't deployed or /admin/ is blocked from the network.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["foodorderingsystem","sourcecodesterfoodorderingsystem"],"ptokens":["food","ordering","sourcecodester","system"],"labels":["fileupload","foodorderingsystem","high","other","php","selfhosted","sourcecodester","vendor"],"campaign_type":null,"search_a":"'-127283':15A,18A '-2026':14A,17A 'admin':5A 'allow':8A 'cve':13A,16A 'file':11A 'food':2A,20A 'handler':7A 'imag':6A 'order':3A 'ordering':21A 'remot':10A 'sourcecodest':1A 'sourcecodester':19A 'system':4A,22A 'unrestrict':9A 'upload':12A","search_b":"'1.0':47B 'accept':48B 'admin':36B,78B 'admin/update_food.php':40B 'attack':73B 'authent':77B 'code':68B 'describ':61B 'execut':69B 'file':24B,50B,65B 'file-upload':23B 'food':27B,37B,44B 'food-ordering-system':26B 'handler':39B 'host':34B 'known':83B 'must':74B 'onlin':43B 'order':28B,45B 'packet':56B 'patch':81B 'php':31B,64B 'public':55B 'remot':67B 'restrict':52B 'say':71B 'self':33B 'self-host':32B 'sourcecodest':35B,42B 'storm':57B 'system':29B,46B 'type':53B 'updat':38B 'upload':25B,49B,62B 'vendor':80B 'without':51B 'write':59B 'write-up':58B","search_c":"'1.0':93C 'admin':109C 'admin/update_food.php':105C 'affect':94C 'argument':116C 'attack':123C 'avail':133C 'cmd':117C 'compon':108C 'exploit':130C 'file':104C 'food':90C 'function':101C 'handler':111C 'identifi':87C 'imag':110C 'issu':97C 'lead':118C 'manipul':113C 'may':124C 'might':135C 'order':91C 'perform':126C 'public':132C 'remot':128C 'sourcecodest':89C 'system':92C 'unknown':100C 'unrestrict':120C 'upload':121C 'use':137C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T02:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-127283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127283","severity":null,"published_at":"2026-11-13T02:18:55+00:00","modified_at":"2026-11-13T02:18:55+00:00","first_seen_at":"2026-11-13T02:41:36+00:00","fetched_at":"2026-11-13T02:41:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127283:3806","url":"https://vulners.com/packetstorm/PACKETSTORM:228489","severity":null,"published_at":"2026-11-13T02:45:07+00:00","modified_at":"2026-11-13T02:45:07+00:00","first_seen_at":"2026-11-13T02:45:07+00:00","fetched_at":"2026-11-13T02:45:07+00:00","note":"NVD page had no content; Packet Storm PoC (admin must be authenticated, /web/admin/update_food.php) and VulDB submission read. No vendor fix found; this is a hobby sample app. Not verified, no primary vendor page. CVSS vector says PR:N while the PoC says auth is needed: conflict noted.","cites":["https://vulners.com/packetstorm/PACKETSTORM:228489","https://vuldb.com/submit/1022954"]}],"documents":[{"id":142064,"url":"https://vulners.com/packetstorm/PACKETSTORM:228489","title":"Online Food Ordering System 1.0 Shell Upload (Packet Storm, nu11secur1ty)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":142065,"url":"https://vuldb.com/submit/1022954","title":"VulDB Submit #1022954: Online Food Ordering System unrestricted upload","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://vulners.com/packetstorm/PACKETSTORM:228489"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}