A critical unrestricted file upload vulnerability in the code-projects Simple Food Ordering System allows unauthenticated remote attackers to execute arbitrary code or modify site content.

This vulnerability is an unrestricted file upload flaw (CWE-434) located in the editproduct.php file. The vulnerability is exploitable by unauthenticated remote attackers who can manipulate the photo parameter to bypass file type restrictions.

The ability for an unauthenticated attacker to upload arbitrary files poses a significant risk to the integrity and availability of the web application. Successful exploitation could lead to full system compromise if an attacker uploads a malicious script, potentially resulting in unauthorized data access or complete service disruption. With a CVSS score of 7.3, this flaw represents a high risk to business operations that rely on this ordering platform.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the editproduct.php file or take the application offline until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting editproduct.php and inspect the upload directory for unexpected file extensions or unauthorized scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized file uploads and restrict access to the administrative endpoints of the application to trusted IP addresses only.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided via the GitHub repository reference.

Due to the lack of a vendor-provided patch and the availability of a public proof-of-concept, this vulnerability poses an immediate threat to the environment. Security teams must prioritize isolating the affected component from public access to prevent exploitation. Please ensure that all web directories are monitored for unauthorized file modifications while waiting for a permanent fix from the vendor.