A critical unrestricted file upload vulnerability in the code-projects Simple Food Ordering System 1.0 allows remote, unauthenticated attackers to compromise system integrity.

The application fails to properly validate file uploads within the addproduct.php script, specifically targeting the photo parameter. This allows an unauthenticated remote attacker to bypass access controls and upload malicious files to the server.

The ability to upload arbitrary files to a web server typically leads to remote code execution, which can result in a total compromise of the host system. Given the CVSS score of 7.3, this represents a high risk to business operations, as it facilitates data theft, unauthorized system modification, and potential lateral movement within the network.

Immediate Action: Since no official patch is available, immediately restrict access to the addproduct.php endpoint or disable the file upload functionality until a secure update is provided by the vendor.

Proactive Monitoring: Review web server logs for suspicious POST requests directed at addproduct.php and scan the web directory for unexpected file types or recently created executable files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads containing malicious extensions or signatures, and ensure the web server service account has minimal file system permissions.

Public Exploit Available: Yes — a published proof-of-concept exists and is attributed to the technical write-up at the referenced GitHub repository.

The presence of a public proof-of-concept significantly increases the likelihood of exploitation by threat actors. Organizations utilizing this system must prioritize the implementation of compensating controls or network-level restrictions immediately, as the lack of an official patch leaves the environment exposed to potential remote code execution.