Cyber Posture

CVE-2025-1166

MediumPublic PoC

Published: 11 February 2025

Published
11 February 2025
Modified
01 August 2025
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0020 41.6th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1166 is a medium-severity Improper Access Control (CWE-284) vulnerability in Remyandrade Food Menu Manager. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates and rejects dangerous file uploads to the update.php endpoint, directly preventing unrestricted upload exploitation per CWE-434.

prevent

Enforces approved authorizations to restrict low-privilege access and manipulations on the vulnerable update.php endpoint, addressing CWE-284 improper access control.

prevent

Identifies, reports, and corrects the specific unrestricted upload flaw in Food Menu Manager 1.0, eliminating the CVE-2025-1166 vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Unrestricted file upload in public web app directly enables remote exploitation (T1190), ingress of arbitrary files/tools (T1105), and web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file endpoint/update.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The…

more

exploit has been disclosed to the public and may be used.

Deeper analysisAI

CVE-2025-1166 is a critical vulnerability in SourceCodester Food Menu Manager 1.0, affecting an unknown functionality within the endpoint/update.php file. The issue enables unrestricted file upload through manipulation of this endpoint. Published on 2025-02-11, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and is associated with CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

The vulnerability can be exploited remotely by an attacker with low privileges, requiring no user interaction and low attack complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to upload arbitrary files to the server.

Advisories and details are available from VulDB entries (vuldb.com/?ctiid.295069, vuldb.com/?id.295069, vuldb.com/?submit.494567) and the vendor site (sourcecodester.com). A proof-of-concept exploit has been publicly disclosed via a GitHub Gist (gist.github.com/jmx0hxq/0ce2c97ca11b2423a203b5719438c9f8).

Details

CWE(s)

Affected Products

remyandrade
food menu manager
1.0

CVEs Like This One

CVE-2025-70457Same vendor: Remyandrade
CVE-2026-4221Shared CWE-284, CWE-434
CVE-2025-1555Shared CWE-284, CWE-434
CVE-2025-1818Shared CWE-284, CWE-434
CVE-2026-2977Shared CWE-284, CWE-434
CVE-2025-0722Shared CWE-284, CWE-434
CVE-2025-2350Shared CWE-284, CWE-434
CVE-2026-1424Shared CWE-284, CWE-434
CVE-2025-2115Shared CWE-284, CWE-434
CVE-2026-3025Shared CWE-284, CWE-434

References