PT-2022-19756 · Unknown · Online Food Ordering System

Published 2022-05-25 · Updated 2022-06-03 · CVE-2022-29651

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Food Ordering System version 1.0

Description The issue is related to an arbitrary file upload vulnerability in the Select Image function, allowing attackers to execute arbitrary code via a crafted PHP file. This can potentially lead to code execution on the server.

Recommendations For Online Food Ordering System version 1.0, consider disabling the Select Image function until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the image upload feature to minimize the risk of malicious file uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-29651

Affected Products

Online Food Ordering System

References · 6

• 🔥 https://hackmd.io/@d4rkp0w4r/Online_Food_Ordering_System_Remote_Code_Execution · Exploit
• https://osv.dev/vulnerability/CVE-2022-29651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29651 · Security Note
• https://hackmd.io/%40d4rkp0w4r/Online_Food_Ordering_System_Remote_Code_Execution · Note
• https://t.me/cibsecurity/43325 · Telegram Post
• https://t.me/cvenotify/31077 · Telegram Post