Executive brief
Neethuharii CafeManagement is a PHP-based café management application that handles customer orders, payments, and staff accounts. This vulnerability allows anyone on the network to create admin accounts and access all customer data and payment records without logging in. An attacker can fully compromise the application's access controls and gain administrative privileges instantly.
Technical details
CafeManagement lacks any authentication or session management (no session_start(), no $_SESSION use); the AddCashierCode.php handler accepts POST parameters uname, pass, role, and status to insert arbitrary privileged accounts with no checks. The application also stores passwords in plaintext. An unauthenticated remote attacker can POST to /AddCashierCode.php with role=admin to create privileged accounts and access the entire admin panel including customer and payment data.
Affected products
- Neethuharii CafeManagement 1.0
Timeline
- 2026-09-23: disclosed