PT-2025-44088 · Code Projects · Simple Food Ordering System

Passed · Published 2025-10-28 · Updated 2025-11-03 · CVE-2025-12378

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Simple Food Ordering System version 1.0

Description A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. The issue affects processing of the file /addproduct.php. Manipulation of the photo argument results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Recommendations Restrict access to the /addproduct.php file to prevent unauthorized uploads. Sanitize the photo parameter to prevent unrestricted file uploads. As a temporary workaround, consider disabling the /addproduct.php functionality until a more permanent solution is available.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-12378

Affected Products

Simple Food Ordering System

References · 11

• 🔥 https://github.com/tinggeogle01-lang/cve/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12378 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12378 · Vendor Advisory
• https://t.me/CVEtracker/35933 · Telegram Post
• https://t.me/cveNotify/141366 · Telegram Post
• https://vuldb.com/?ctiid.330214 · Note
• https://t.me/cveNotify/140618 · Telegram Post
• https://twitter.com/CVEnew/status/1983048888417190182 · Twitter Post
• https://vuldb.com/?submit.674562 · Note
• https://code-projects.org · Note
• https://vuldb.com/?id.330214 · Note