CVE-2025-12378

Name of the Vulnerable Software and Affected Versions code-projects Simple Food Ordering System version 1.0

Description A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. The issue affects processing of the file /addproduct.php. Manipulation of the photo argument results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be exploited.

Recommendations Restrict access to the /addproduct.php file to prevent unauthorized uploads. Sanitize the photo parameter to prevent unrestricted file uploads. As a temporary workaround, consider disabling the /addproduct.php functionality until a more permanent solution is available.