CVE-2025-1166: Food Menu Manager RCE Vulnerability

CVE-2025-1166 Overview

CVE-2025-1166 is an unrestricted file upload vulnerability in SourceCodester Food Menu Manager 1.0. The flaw resides in the endpoint/update.php script, which fails to validate uploaded file types or contents. An authenticated remote attacker with low privileges can abuse this functionality to upload arbitrary files, including server-side scripts. The exploit details have been publicly disclosed, increasing the risk of opportunistic abuse against exposed deployments. The vulnerability is tracked under CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Remote attackers can upload arbitrary files to vulnerable Food Menu Manager 1.0 instances, potentially leading to code execution on the hosting web server.

Affected Products

SourceCodester Food Menu Manager 1.0
remyandrade:food_menu_manager component (CPE: cpe:2.3:a:remyandrade:food_menu_manager:1.0)
Deployments exposing endpoint/update.php to untrusted users

Discovery Timeline

2025-02-11 - CVE-2025-1166 published to NVD
2025-08-01 - Last updated in NVD database

Technical Details for CVE-2025-1166

Vulnerability Analysis

The vulnerability stems from missing validation in the file upload handler at endpoint/update.php. The script accepts user-supplied files without enforcing extension allowlists, MIME type checks, or content inspection. Attackers can submit a crafted multipart HTTP POST request containing executable PHP code disguised as a menu image or document.

Once written to a web-accessible directory, the uploaded file can be requested directly from the browser. The web server interprets the file as PHP and executes its contents, yielding remote code execution in the application context. The attack requires only low-level authentication and no user interaction. A public proof-of-concept has been published on GitHub Gist, lowering the technical barrier for exploitation. EPSS data places exploitation probability at 0.198%.

Root Cause

The root cause is the absence of upload restrictions in endpoint/update.php. The application trusts client-supplied filenames and content types and writes the file directly to disk. This combination of [CWE-284] and [CWE-434] removes any meaningful boundary between unauthenticated input and server-side execution.

Attack Vector

The attack vector is network-based. An attacker with valid low-privilege credentials sends an HTTP POST request to endpoint/update.php containing a malicious file payload. After upload, the attacker browses to the file location to trigger execution. Refer to the VulDB entry #295069 for additional technical context.

No verified exploit code is reproduced here. See the published proof-of-concept script for technical specifics.

Detection Methods for CVE-2025-1166

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing in upload directories used by Food Menu Manager
HTTP POST requests to endpoint/update.php originating from unusual IP addresses or user agents
Outbound network connections initiated by the web server process to attacker-controlled hosts after a successful upload

Detection Strategies

Inspect web server access logs for POST requests to endpoint/update.php followed by GET requests to newly created files
Monitor file integrity on web-root directories to flag creation of executable scripts outside of normal deployment activity
Correlate authentication events with upload activity to identify abuse of low-privilege accounts

Monitoring Recommendations

Enable verbose logging on the PHP interpreter and capture the parent process chain when scripts execute from upload directories
Forward web server, authentication, and host telemetry to a centralized analytics platform for correlation
Establish a baseline of normal file types served from the application and alert on deviations

How to Mitigate CVE-2025-1166

Immediate Actions Required

Restrict access to endpoint/update.php at the web server or reverse proxy layer until a fix is applied
Audit upload directories for unauthorized files and remove any suspicious scripts
Rotate credentials for any accounts with upload privileges, as low-privilege access is sufficient to exploit this flaw

Patch Information

At the time of publication, no vendor advisory or official patch has been published for SourceCodester Food Menu Manager 1.0. Monitor the SourceCodester project page and the VulDB entry for updates. Organizations should consider decommissioning the application or replacing it with a maintained alternative if no patch becomes available.

Workarounds

Configure the web server to deny execution of scripts within upload directories using directives such as php_admin_flag engine off or equivalent location blocks
Enforce server-side allowlists for file extensions and validate MIME types and magic bytes before persisting uploads
Place the application behind a web application firewall with rules blocking executable payloads in multipart uploads
Remove or disable the endpoint/update.php route if it is not required for production operation

bash

# Example Apache configuration to prevent PHP execution in upload directories
<Directory "/var/www/food_menu_manager/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar
    Options -ExecCGI
</Directory>