CVE-2025-1166
Published: 11 February 2025
Summary
CVE-2025-1166 is a medium-severity Improper Access Control (CWE-284) vulnerability in Remyandrade Food Menu Manager. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates and rejects dangerous file uploads to the update.php endpoint, directly preventing unrestricted upload exploitation per CWE-434.
Enforces approved authorizations to restrict low-privilege access and manipulations on the vulnerable update.php endpoint, addressing CWE-284 improper access control.
Identifies, reports, and corrects the specific unrestricted upload flaw in Food Menu Manager 1.0, eliminating the CVE-2025-1166 vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload in public web app directly enables remote exploitation (T1190), ingress of arbitrary files/tools (T1105), and web shell deployment (T1505.003).
NVD Description
A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file endpoint/update.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The…
more
exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1166 is a critical vulnerability in SourceCodester Food Menu Manager 1.0, affecting an unknown functionality within the endpoint/update.php file. The issue enables unrestricted file upload through manipulation of this endpoint. Published on 2025-02-11, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
The vulnerability can be exploited remotely by an attacker with low privileges, requiring no user interaction and low attack complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to upload arbitrary files to the server.
Advisories and details are available from VulDB entries (vuldb.com/?ctiid.295069, vuldb.com/?id.295069, vuldb.com/?submit.494567) and the vendor site (sourcecodester.com). A proof-of-concept exploit has been publicly disclosed via a GitHub Gist (gist.github.com/jmx0hxq/0ce2c97ca11b2423a203b5719438c9f8).
Details
- CWE(s)