CVE-2023-24646 – This vulnerability allows attackers to upload a... (How to Fix)

Q: What is the severity of CVE-2023-24646?

CVE-2023-24646 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows attackers to upload arbitrary PHP files to the Food Ordering System v2.0 via the /fos/admin/ajax.php endpoint, leading to remote code execution. Any organization using the vulnerable version of this software is affected. Attackers can gain complete control over the web server.

📋 TL;DR

This vulnerability allows attackers to upload arbitrary PHP files to the Food Ordering System v2.0 via the /fos/admin/ajax.php endpoint, leading to remote code execution. Any organization using the vulnerable version of this software is affected. Attackers can gain complete control over the web server.

💻 Affected Systems

Products:

Food Ordering System

Versions: v2.0

Operating Systems: Any OS running PHP web server

Default Config Vulnerable: ⚠️ Yes

Notes: Requires PHP environment and the vulnerable component accessible via web.

📦 What is this software?

Online Food Ordering System by Online Food Ordering System Project

View all CVEs affecting Online Food Ordering System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise, data exfiltration, ransomware deployment, and lateral movement to other systems in the network.

🟠

Likely Case

Web server takeover, defacement, data theft, and installation of backdoors for persistent access.

🟢

If Mitigated

Limited impact with proper file upload validation, web application firewalls, and restricted file permissions.

🌐 Internet-Facing: HIGH - Directly exploitable via HTTP requests without authentication.

🏢 Internal Only: MEDIUM - Still exploitable by internal attackers or compromised internal systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple HTTP POST request with malicious PHP file upload to vulnerable endpoint.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: Not available

Restart Required: No

Instructions:

No official patch available. Consider upgrading to a newer version if available or implementing workarounds.

🔧 Temporary Workarounds

Restrict file uploads

all

Implement strict file type validation and whitelist only allowed extensions.

Modify /fos/admin/ajax.php to validate file extensions and MIME types

Disable vulnerable endpoint

all

Temporarily disable or restrict access to /fos/admin/ajax.php.

Add authentication requirement or IP restriction to the endpoint

🧯 If You Can't Patch

Implement web application firewall (WAF) rules to block malicious file uploads
Restrict file permissions and store uploads outside web root directory

🔍 How to Verify

Check if Vulnerable:

Attempt to upload a PHP file to /fos/admin/ajax.php and check if it executes.

Check Version:

Check software version in admin panel or configuration files.

Verify Fix Applied:

Test file upload with PHP extension; should be rejected or stored safely.

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads to /fos/admin/ajax.php
PHP file execution from upload directory

Network Indicators:

HTTP POST requests to /fos/admin/ajax.php with file uploads

SIEM Query:

source="web_server" AND uri="/fos/admin/ajax.php" AND method="POST" AND file_extension="php"

📊 Metadata

CVE ID: CVE-2023-24646

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: February 13, 2023

Last Updated: March 21, 2025

🔗 References

https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Food-Ordering-System-v2.0 Exploit,Third Party Advisory
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Food-Ordering-System-v2.0 Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-24646, you might also want to check these: