CVE-2025-6161 SourceCodester Simple Food Ordering System editproduct.php unrestricted upload
Attackers can upload malicious files via the photo parameter in editproduct.php, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6161?
CVE-2025-6161 is a medium-severity vulnerability in SourceCodester Simple Food Ordering System, published on 17 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown function of the file /editproduct.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-6161?
It affects 1 product.
Products include Fabian Simple Food Ordering System.
How do I fix CVE-2025-6161?
No fix has been published for CVE-2025-6161 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-6161 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-6161 exists.
Other vulnerabilities in SourceCodester Simple Food Ordering System
- CVE-2025-12378 code-projects Simple Food Ordering System addproduct.php unrestricted upload
- CVE-2025-12301 code-projects Simple Food Ordering System editproduct.php unrestricted upload
- CVE-2025-11396 code-projects Simple Food Ordering System product.php sql injection
- CVE-2025-13290 code-projects Simple Food Ordering System saveorder.php sql injection
- CVE-2025-12298 code-projects Simple Food Ordering System editcategory.php cross site scripting
Sources
Also known as GHSA-496h-w7f8-7rxw.