| Titel | GitHub robo-cafe-rms 1.0 Unrestricted Upload |
|---|
| Beschreibung | An authenticated arbitrary file upload vulnerability exists in the Robo Cafe Restaurant Management System (robo-cafe-rms) version 1.0. The application's backend upload functionalities fail to validate file extensions or verify incoming MIME-types. An authenticated attacker can exploit this weakness by uploading a malicious PHP script disguised as an image for menu of food. Because the application saves files to a web-accessible public path, navigating directly to the destination folder triggers server-side execution of the script, leading to complete Remote Code Execution (RCE) on the host server.
PROOF OF CONCEPT (PoC) / REPRODUCTION STEPS:
1. Log into the robo-cafe-rms web application using administrative credentials.
2. Navigate to the http://localhost:8000/admin/manage and if it asks for admin login, use this credentials username doc211 and password 1111 to get access to admin panel.
3. Then navigate to http://localhost:8000/admin/manage-food.php page.
4. Prepare a local script named "exploit.php" containing basic test code: <?php phpinfo(); ?>
5. Upload the "exploit.php" file through the Update actions to update menu.
6. Identify the upload directory path using browser inspection tools.
7. Access the file directly by visiting its URL in the web browser (e.g., http://localhost:8000/images/food/Food-Name-6093.php).
8. Observe the executed PHP configuration page on the screen, verifying full Remote Code Execution.
|
|---|
| Quelle | ⚠️ https://github.com/mwasikz/robo-cafe-rms |
|---|
| Benutzer | dexter-morgan (UID 100687) |
|---|
| Einreichung | 19.08.2026 23:49 (vor 1 Monat) |
|---|
| Moderieren | 28.09.2026 22:10 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 411165 [mwasikz robo-cafe-rms bis 228c44a02823f04e85db32b7137809a2856148fc manage-food.php erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|