CVE-2026-116603 Details

A vulnerability allowing unrestricted file upload has been identified in SourceCodester Online Food Ordering System version 1.0. The issue resides in the admin/add_food.php file, where the image upload functionality fails to properly validate file extensions or content. This flaw enables remote attackers to upload malicious files, such as PHP scripts, which can be executed on the server. The vulnerability requires an authenticated admin session, but can potentially be exploited by chaining with an authentication bypass issue.

To address this vulnerability, implement a strict allow-list for image file extensions, ensuring only safe formats like JPG, JPEG, PNG, GIF, and WEBP are accepted. Validate that uploaded files are genuine images using a function like getimagesize(). Store uploaded files outside the webroot or in a directory where PHP execution is disabled, and rename files to prevent predictable naming. Additionally, consider adding an .htaccess rule to disable PHP execution in the images directory.