Robo Cafe Rms
Monthly
Stored cross-site scripting in mwasikz robo-cafe-rms allows an authenticated low-privilege user to inject arbitrary script into the profile Name, Address, or City fields, which then executes in the browser of any victim who views the affected profile page. Publicly available exploit code exists, and because the project follows a rolling-release model, no version boundary or vendor patch can be cited for the affected or fixed code. The risk is low-to-moderate in practice: exploitation requires a valid account, the injected content only fires when another user loads the poisoned view, and the product has a very small deployment base. Vendor contact was attempted early in the disclosure process and produced no response.
Unrestricted file upload in mwasikz robo-cafe-rms (the manage-food.php food-management endpoint) lets an attacker with an authenticated high-privilege admin session upload arbitrary files to the web server over the network, which can lead to remote code execution if the server executes uploaded PHP from the upload directory. All deployments are affected, since the project ships as a rolling release with no versioned affected or fixed builds (CPE cpe:2.3:a:mwasikz:robo-cafe-rms:*:*:*:*:*:*:*:*). Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; VulDB rates the issue CVSS 4.0 5.1 (Medium), while our independent CVSS 3.1 assessment of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H places it higher (7.2 High) because successful upload can yield full confidentiality, integrity and availability impact on the host. The main limiting factor is the admin-authentication prerequisite (PR:H), which makes this an authenticated post-compromise escalation rather than an unauthenticated remote compromise.
Stored cross-site scripting in mwasikz robo-cafe-rms allows an authenticated low-privilege user to inject arbitrary script into the profile Name, Address, or City fields, which then executes in the browser of any victim who views the affected profile page. Publicly available exploit code exists, and because the project follows a rolling-release model, no version boundary or vendor patch can be cited for the affected or fixed code. The risk is low-to-moderate in practice: exploitation requires a valid account, the injected content only fires when another user loads the poisoned view, and the product has a very small deployment base. Vendor contact was attempted early in the disclosure process and produced no response.
Unrestricted file upload in mwasikz robo-cafe-rms (the manage-food.php food-management endpoint) lets an attacker with an authenticated high-privilege admin session upload arbitrary files to the web server over the network, which can lead to remote code execution if the server executes uploaded PHP from the upload directory. All deployments are affected, since the project ships as a rolling release with no versioned affected or fixed builds (CPE cpe:2.3:a:mwasikz:robo-cafe-rms:*:*:*:*:*:*:*:*). Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; VulDB rates the issue CVSS 4.0 5.1 (Medium), while our independent CVSS 3.1 assessment of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H places it higher (7.2 High) because successful upload can yield full confidentiality, integrity and availability impact on the host. The main limiting factor is the admin-authentication prerequisite (PR:H), which makes this an authenticated post-compromise escalation rather than an unauthenticated remote compromise.