Cafemanagement
Monthly
Unauthenticated account creation in Neethuharii CafeManagement lets any remote attacker who can reach the AddCashierCode.php endpoint provision a new cashier account with attacker-chosen uname, pass, role and status values, because the addcashier function performs no authorization check (CWE-285). Publicly available exploit code exists - a third-party GitHub writeup demonstrates the missing-authentication account-creation path - but there is no sign of active exploitation and the CVE is not in CISA KEV. The vendor was contacted early and never responded, so no fixed release is available; the practical impact is bounded to Low confidentiality, integrity and availability effects (cashier-level account creation rather than administrative takeover) and should be weighed against the project's limited real-world production footprint, meaning the headline CVSS 4.0 score of 6.9 overstates real-world priority.
Unauthenticated SQL injection in CafeManagement's CafePortalLogin.php login handler allows remote attackers to bypass authentication and potentially read or modify backend data. Publicly available exploit code exists, including a Medium writeup, and the vendor did not respond, leaving a rolling-release product without an official patched version; severity signals conflict, with the supplied CVSS 4.0 score of 5.5 understating the independently assessed high confidentiality and integrity impact.
Unrestricted file upload in the AddProductCode.php endpoint of Neethuharii CafeManagement lets unauthenticated remote attackers upload arbitrary files, including PHP scripts, by manipulating the 'image' parameter - a public proof-of-concept writeup by researcher 'mr.yk404' describes achieving remote code execution through this path, and exploitation requires no authentication, privileges, or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, E:P). The vendor was contacted but did not respond, and because CafeManagement uses a rolling release model, no affected or fixed version numbers are published; the CPE entry (cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*) treats all versions as potentially vulnerable. Vendor scoring places this at CVSS 4.0 6.9, while our independent assessment rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because successful upload of executable content to a web-reachable directory yields full confidentiality, integrity, and availability impact; the practical limiter is deployment scarcity, as this is a niche hobbyist application rarely exposed in production.
Unauthenticated account creation in Neethuharii CafeManagement lets any remote attacker who can reach the AddCashierCode.php endpoint provision a new cashier account with attacker-chosen uname, pass, role and status values, because the addcashier function performs no authorization check (CWE-285). Publicly available exploit code exists - a third-party GitHub writeup demonstrates the missing-authentication account-creation path - but there is no sign of active exploitation and the CVE is not in CISA KEV. The vendor was contacted early and never responded, so no fixed release is available; the practical impact is bounded to Low confidentiality, integrity and availability effects (cashier-level account creation rather than administrative takeover) and should be weighed against the project's limited real-world production footprint, meaning the headline CVSS 4.0 score of 6.9 overstates real-world priority.
Unauthenticated SQL injection in CafeManagement's CafePortalLogin.php login handler allows remote attackers to bypass authentication and potentially read or modify backend data. Publicly available exploit code exists, including a Medium writeup, and the vendor did not respond, leaving a rolling-release product without an official patched version; severity signals conflict, with the supplied CVSS 4.0 score of 5.5 understating the independently assessed high confidentiality and integrity impact.
Unrestricted file upload in the AddProductCode.php endpoint of Neethuharii CafeManagement lets unauthenticated remote attackers upload arbitrary files, including PHP scripts, by manipulating the 'image' parameter - a public proof-of-concept writeup by researcher 'mr.yk404' describes achieving remote code execution through this path, and exploitation requires no authentication, privileges, or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, E:P). The vendor was contacted but did not respond, and because CafeManagement uses a rolling release model, no affected or fixed version numbers are published; the CPE entry (cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*) treats all versions as potentially vulnerable. Vendor scoring places this at CVSS 4.0 6.9, while our independent assessment rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because successful upload of executable content to a web-reachable directory yields full confidentiality, integrity, and availability impact; the practical limiter is deployment scarcity, as this is a niche hobbyist application rarely exposed in production.