Executive brief
A vulnerability exists in the SourceCodester Online Food Ordering System, a web application used for managing food orders. An attacker can remotely access sensitive server files, including database configuration files and credentials, by manipulating web addresses. This could lead to a full compromise of the system's data and unauthorized access to the underlying server.
Technical details
A Local File Inclusion (LFI) vulnerability exists in SourceCodester Online Food Ordering System 2.0 within the 'page' GET parameter of /index.php and /admin/index.php. The application passes user-supplied input directly to a PHP include() statement without proper sanitization or path validation. A remote, unauthenticated attacker can exploit this by using directory traversal sequences or PHP stream wrappers (e.g., php://filter) to disclose sensitive source code, such as database connection strings (db_connect.php), or potentially achieve remote code execution. A public exploit (PoC) is available. Mitigation involves implementing a whitelist for the 'page' parameter and using the basename() function to strip path components.
Affected products
- SourceCodester Online Food Ordering System 2.0
Timeline
- 2026-05-15: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-03: advisory: CVE published by VulDB/NVD.