Executive brief
TastyIgniter, an online restaurant management system, contains a security flaw in its Media Manager component. A user with low-level access can upload a specially crafted image file that, when viewed by an administrator, allows the attacker to hijack the administrator's session. This could lead to full unauthorized control over the restaurant's management platform, including the ability to change credentials and access sensitive business data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Media Manager of TastyIgniter v4.3.0 due to insufficient validation and sanitization of uploaded SVG files. An authenticated attacker with low privileges can upload an SVG containing malicious JavaScript. When an administrator views the file, the script executes in their browser context. This can be chained with a Cross-Site Request Forgery (CSRF) attack to extract the administrator's CSRF token, enabling the attacker to perform unauthorized administrative actions such as credential modification. The manufacturer has released a fix, and users are advised to update to the latest version.
Affected products
- TastyIgniter TastyIgniter 4.3.0
Timeline
- 2026-07-27: disclosed
- 2026-07-27: advisory
- 2026-07-27: patched: Manufacturer has released a fix; update to latest version recommended.