CVE-2025-6161 is a high (CVSS 7.3) unrestricted file upload flaw in SourceCodester Simple Food Ordering System 1.0. The record says the photo argument in editproduct.php accepts files without proper checks, and a public exploit has been disclosed. No fixed version is named in the record.
What's affected
- Product: SourceCodester Simple Food Ordering System, listed in the record under the fabian vendor name.
- Affected version: 1.0.
- Vulnerable file and argument:
/editproduct.php, thephotoparameter. - Weaknesses: CWE-434 (unrestricted upload of a dangerous file type) and CWE-284 (improper access control).
- Fixed version: none named in the record.
- CVSS 3.1: 7.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. No login is needed according to the vector. - Public exploit: the record says the exploit has been disclosed to the public and may be used.
- Known exploited: no, the record is not on the CISA KEV list.
How to check if you're exposed
Find the application and check whether it is accepting uploads:
find /var/www -name "editproduct.php" 2>/dev/null
ls -la /var/www/html/*/uploads 2>/dev/null
find /var/www -type f \( -name "*.php" -o -name "*.phtml" \) -path "*upload*" 2>/dev/null
Adjust the paths for your web root. Script files inside an upload or image folder are a warning sign, because product photos should be image files only.
Also review web server logs for POST requests to /editproduct.php, and check who can reach the admin area of the application. If it is open to the internet and you cannot show that the upload folder holds only images, treat the server as potentially compromised.
What to do now
- Find every deployment of Simple Food Ordering System 1.0, including demo or test copies.
- Check the vendor page and the CVE record references for a fix. None is named in the record.
- Block script execution in the upload directory in the web server configuration, so uploaded files are served as static content only.
- Restrict
/editproduct.phpto authenticated administrators on a trusted network, or take the application offline. - If you maintain the code, accept only an allow list of image types, check the real content type, rename files on save, and store uploads outside the web root.
- Review the upload folder for non-image files, and rebuild the host if you find any.
Why it matters
Unrestricted upload (CWE-434) lets a client put a file of the attacker's choosing on the server. If that file is a script and the web server will run it, the upload becomes code execution. Even when it does not run, uploads can fill disks, host malware or overwrite other files.
The improper access control entry, CWE-284, points to a second problem: the vector shows the route can be reached without login. A product edit page should be limited to administrators.
Sample applications like this are written to teach or to start a project. They rarely have the checks a production system needs. If the application carries real orders or customer data, the safest move is to replace it with a maintained product. The record does not claim exploitation in the wild, but it does say a working exploit is public.
Quick check
Is there a fixed version?
The CVE record names none. Use the mitigations above, or replace the application.
What is the single most useful mitigation?
Stop uploaded files from being executed by the web server, and restrict who can reach the edit page.
Sources
- Safeguard Gold entry for CVE-2025-6161
- github.com/kakalalaww/CVE/issues/17 (listed in the CVE record, not fetched)
- vuldb.com/?ctiid.312636 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
