CVE-2023-2246

published 2023-04-23

CVE-2023-2246: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the…

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
online_pizza_ordering_system_project	online_pizza_ordering_system	—	—
sourcecodester	online_pizza_ordering_system	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /admin/ajax.php?action=save_settings↗

url https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-opos.zip↗

• → The exploit sends the uploaded file with Content-Type 'application/octet-stream' regardless of actual file type — flag multipart uploads to /admin/ajax.php with this content type. ↗

• · The vulnerability is unauthenticated — no session cookie or login is required to upload a file, meaning perimeter authentication controls alone are insufficient. ↗
• · The affected endpoint accepts arbitrary file types via the 'img' argument with no server-side extension or MIME-type validation, enabling direct PHP webshell upload. ↗
• · The exploit was tested on LAMP/Fedora with Apache 2.4.34 and PHP 7.1.23; environments with directory listing disabled on /assets/img/ would prevent the attacker from enumerating the uploaded file's URL, but the upload itself would still succeed. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434