EUVD-2026-85635
GHSA-85q8-f6qc-gf9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed CafeManagement instance
-
DeliverySend crafted POST to AddCashierCode.php
-
ExploitBypass missing authorization on addcashier
-
ExecutionCreate attacker-controlled cashier account
-
ImpactGain unauthorized application access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected endpoint is AddCashierCode.php and its addcashier function in Neethuharii CafeManagement; exploitation requires the application to be network-reachable and consists of submitting the uname/pass/role/status parameters to that script, which performs no authorization check (CWE-285). Per the CVSS vector this is unauthenticated (PR:N), needs no user interaction (UI:N), and works against the default configuration since the missing check is inherent to the code path. The primary practical limit is exposure and prevalence: the product is an obscure PHP project rarely deployed in production, and impact is bounded to creating a cashier-level account (all impacts rated Low), not full administrative takeover. |
| Impact | This is a classic low-tier VulDB disclosure whose headline CVSS 4.0 score of 6.9 (MEDIUM) substantially overstates real-world priority. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N with all impacts rated Low (VC:L/VI:L/VA:L) and E:P (proof-of-concept exploit maturity) describes an unauthenticated network-reachable improper-authorization flaw (CWE-285) in the addcashier function of AddCashierCode.php, where an attacker can create a cashier account without authorization. Signals are consistent with each other: PR:N/AC:L/UI:N confirms trivial reachability, and a public exploit write-up exists (GitHub, yashkeral/cve-writeups). However, exploitation is 'publicly available exploit code exists' - NOT confirmed active exploitation; there is no CISA KEV listing and no EPSS score in the provided data. The decisive downgrade factor is prevalence: Neethuharii CafeManagement is an obscure, individual-developer PHP project with no meaningful production footprint, so the effective real-world risk is far lower than the 6.9 suggests. No EPSS was supplied, so widespread-scanning likelihood cannot be quantified. Net: low operational priority despite a MEDIUM score and a published POC. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP POST to AddCashierCode.php supplying uname/pass/role/status parameters, and because the endpoint fails to enforce authorization, a new cashier account is created without any valid session. A public proof-of-concept write-up documenting this missing-auth account creation is available on GitHub, and given AV:N/AC:L/PR:N/UI:N the request can be replayed trivially against any exposed instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated account creation in Neethuharii CafeManagement lets any remote attacker who can reach the AddCashierCode.php endpoint provision a new cashier account with attacker-chosen uname, pass, role and status values, because the addcashier function performs no authorization check (CWE-285). Publicly available exploit code exists - a third-party GitHub writeup demonstrates the missing-authentication account-creation path - but there is no sign of active exploitation and the CVE is not in CISA KEV. The vendor was contacted early and never responded, so no fixed release is available; the practical impact is bounded to Low confidentiality, integrity and availability effects (cashier-level account creation rather than administrative takeover) and should be weighed against the project's limited real-world production footprint, meaning the headline CVSS 4.0 score of 6.9 overstates real-world priority.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer was contacted but never replied and the wildcarded CPE confirms no fixed version was published - so remediation must be compensating. First, remove AddCashierCode.php entirely from any internet-facing deployment if it is not needed, which eliminates the issue with zero residual risk. If cashier provisioning is required, gate the script at the web server or reverse proxy (for example an Nginx location block or Apache <Location> directive requiring authentication and allow-listing a management IP range) and move it behind the application's authenticated administrative area; the trade-off is that legitimate provisioning traffic must now carry credentials or originate from the approved network. Add a WAF or proxy rule rejecting unauthenticated POSTs to AddCashierCode.php, and apply server-side role validation so the role and status parameters can no longer be set by an unauthenticated caller. Because exploit code is public, log and alert on requests to AddCashierCode.php and audit existing cashier accounts for unexpected entries created through this path; note that blocking the endpoint will break any legitimate automated cashier-creation workflow until it is re-issued with authentication. Reference the public writeup at https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md and the VulDB record at https://vuldb.com/vuln/408959 for validation detail.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-285 (Improper Authorization) in a PHP web application: AddCashierCode.php exposes the addcashier function, which accepts the uname, pass, role and status parameters and commits them without verifying that the caller is authenticated or holds an administrative role. Because the check is absent from the code path itself, the flaw holds in a default installation rather than depending on a misconfiguration. The published CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) confirms network reachability with no attack complexity, no prerequisites, no privileges required (PR:N, i.e. unauthenticated) and no user interaction, and its E:P metric records that proof-of-concept exploit code is publicly available; the subsequent-subsequent-system metrics are all None, so the compromise stays inside the vulnerable component. Our independent assessment maps the same behavior to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - unauthenticated remote access with Low impact across all three pillars - which is a fairer representation than the CVSS 4.0 6.9 headline. The CPE cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:* is version-wildcarded, indicating that no patched release existed at disclosure time and that every published build of the project carries the same unguarded AddCashierCode.php.
Know when Cafemanagement gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote request (AV:N/AC:L/PR:N/UI:N) to a code path with no authorization check; impact limited to unauthorized cashier-account creation, so C/I/A each Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Cafemanagement
View allUnauthenticated SQL injection in CafeManagement's CafePortalLogin.php login handler allows remote attackers to bypass au
Unrestricted file upload in the AddProductCode.php endpoint of Neethuharii CafeManagement lets unauthenticated remote at
Exploit-DB