CVE-2023-2246: online_pizza_ordering_system_project online_pizza_ordering_system
Vulnerability summary
CVE-2023-2246 is a critical (CVSS 9.8) vulnerability in online_pizza_ordering_system_project online_pizza_ordering_system. EPSS estimates a 3.62% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Duplicates 1Timeline
- 23-04-2023PublishedVulnerability first disclosed.
- 22-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227236.
CVSS metrics
5 scores · 2 sources · 3 versions- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST6.5MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
3.62%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.62% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (docs.google.com)
Maturity: unknown
Online Pizza Ordering System v1.0 - Unauthenticated File Upload
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Online_pizza_ordering_system_project1 product
Sourcecodester1 product
2 vendors · 2 products
References
3 links- docs.google.com/document/d/1Bzt1UOXHJYyNFvTUsMO4zfbiDd_cKxuEygjAww2GcZQ/editExploitThird Party Advisory