EUVD-2026-85419
GHSA-rp3m-x7wg-gv6h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AddProductCode.php endpoint remotely
-
DeliveryUpload malicious PHP via 'image' param
-
ExploitBypass absent file-type validation
-
ExecutionAccess uploaded webshell URL
-
ImpactExecute arbitrary commands on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the AddProductCode.php upload endpoint of Neethuharii CafeManagement, which per the CVSS vector needs no authentication, no privileges, and no user interaction (AV:N/PR:N/UI:N/AC:L). The concrete precondition is that the 'image' upload parameter performs no server-side validation of file extension or content. Realistic RCE further depends on the uploaded file being written to a web-accessible directory where the server executes PHP; if uploads are stored outside the webroot or with sanitized names, impact degrades to non-executable file placement. The main practical limiter is deployment scarcity - this is a niche hobbyist application rarely exposed in production. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, low-complexity remote file upload, and the E:P (Proof-of-Concept) exploit-maturity flag is corroborated by a public POC - a Medium writeup by 'mr.yk404' explicitly titled around achieving Remote Code Execution. However, the signals conflict on impact: VulDB rates impact as low across the board (VC:L/VI:L/VA:L, yielding 6.9), while the referenced POC claims full RCE, which for an unrestricted upload into a PHP application (webshell drop) would justify HIGH impact across confidentiality, integrity and availability. This gap is the crux - if the uploaded file lands in a web-accessible, script-executable directory, real risk is far higher than the 6.9 suggests. Mitigating the urgency: there is no EPSS score provided and no CISA KEV listing, so there is no evidence of widespread or automated exploitation, and the affected product (Neethuharii CafeManagement) is an obscure hobby/student PHP project with negligible production footprint. Net assessment: technically easy to exploit with public code, but low real-world priority for most organizations because the product is essentially never deployed at scale - this is a 'high-ease, low-reach' issue rather than a broad threat. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted multipart request to AddProductCode.php, supplying a malicious PHP file through the 'image' parameter, which is stored without validation of type or content. The attacker then requests the uploaded file's URL to execute it as a webshell, gaining arbitrary command execution on the host. A public POC demonstrating this file-upload-to-RCE chain has been released (Medium article), lowering the barrier to reuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unrestricted file upload in the AddProductCode.php endpoint of Neethuharii CafeManagement lets unauthenticated remote attackers upload arbitrary files, including PHP scripts, by manipulating the 'image' parameter - a public proof-of-concept writeup by researcher 'mr.yk404' describes achieving remote code execution through this path, and exploitation requires no authentication, privileges, or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, E:P). The vendor was contacted but did not respond, and because CafeManagement uses a rolling release model, no affected or fixed version numbers are published; the CPE entry (cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*) treats all versions as potentially vulnerable. Vendor scoring places this at CVSS 4.0 6.9, while our independent assessment rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because successful upload of executable content to a web-reachable directory yields full confidentiality, integrity, and availability impact; the practical limiter is deployment scarcity, as this is a niche hobbyist application rarely exposed in production.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was contacted early but did not respond, and the rolling release model means there is no tagged fixed version to cite - do not assume an update resolves this. Until a fix appears, the highest-value compensating control is to block or remove the vulnerable entry point: restrict POST/multipart requests to AddProductCode.php at the reverse proxy or WAF (or delete the script if product creation via that code path is not needed), accepting the trade-off that legitimate product image uploads through that flow will break. Where the function must remain, enforce server-side validation in the upload handler - accept only a strict extension/MIME allow-list (e.g. jpg/png/webp), re-encode or verify image content with getimagesize()/finfo, generate randomized filenames with no user-supplied extension, and cap file size; note that client-side or extension-only checks are trivially bypassed (e.g. .phtml, double extensions) and should not be relied on. Store uploads outside the webroot and serve them through a validating script, or, if they must live in a web-served directory, disable script execution there (Apache: 'php_admin_flag engine off' plus 'RemoveHandler .php .phtml' in the upload directory's .htaccess; nginx: return 403 for \.php$ within the upload location) - the side effect is that any legitimate PHP-facing behavior on that path stops working. Additionally require authentication/authorization on the AddProductCode.php endpoint and log/monitor for multipart uploads to it, since CVSS PR:N means current deployments expose it unauthenticated. Consult the vendor advisory and tracking entries at https://vuldb.com/vuln/408919 and https://vuldb.com/cve/CVE-2026-96513 for any later updates, and note the public RCE writeup at the Medium reference as evidence that unpatched, internet-exposed instances should be taken offline pending mitigation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-434 unrestricted upload of a file with a dangerous type, rooted in missing server-side validation of the 'image' argument handled by AddProductCode.php in a PHP-based application. Multipart form uploads reaching that script are apparently accepted without enforcing file extension allow-lists, MIME-type verification, or content inspection, so a request can place an attacker-controlled file into a location the application writes to. Remote code execution is not guaranteed by the upload alone: it additionally depends on the file being stored in a web-accessible directory whose names are predictable enough to request, and on the web server executing PHP in that directory. If uploads are written outside the webroot, renamed with sanitized/randomized names, or served from a location where script execution is disabled, the impact degrades to non-executable file placement (e.g. stored HTML/script content usable for client-side attacks rather than server compromise). The technical stack is plain PHP file-upload handling with no framework-level hardening evidenced in the disclosure, which is why the vulnerable parameter maps directly to the CWE-434 class. Note that the CVSS 4.0 vector published by the originator scores only Low for vulnerable-system confidentiality, integrity, and availability with E:P and no subsequent-system impact, whereas the independent CVSS 3.1 assessment scores High across C/I/A under S:U; the divergence reflects differing assumptions about whether the uploaded file is actually executable in the deployment rather than a dispute about the underlying upload defect.
Know when Cafemanagement gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote upload of executable PHP via the 'image' param with a public RCE POC justifies PR:N/UI:N and full C:H/I:H/A:H via webshell code execution.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
More in Cafemanagement
View allUnauthenticated account creation in Neethuharii CafeManagement lets any remote attacker who can reach the AddCashierCode
Unauthenticated SQL injection in CafeManagement's CafePortalLogin.php login handler allows remote attackers to bypass au
Exploit-DB