| शीर्षक | GitHub robo-cafe-rms 1.0 Unrestricted Upload |
|---|
| विवरण | An authenticated arbitrary file upload vulnerability exists in the Robo Cafe Restaurant Management System (robo-cafe-rms) version 1.0. The application's backend upload functionalities fail to validate file extensions or verify incoming MIME-types. An authenticated attacker can exploit this weakness by uploading a malicious PHP script disguised as an image for menu of food. Because the application saves files to a web-accessible public path, navigating directly to the destination folder triggers server-side execution of the script, leading to complete Remote Code Execution (RCE) on the host server.
PROOF OF CONCEPT (PoC) / REPRODUCTION STEPS:
1. Log into the robo-cafe-rms web application using administrative credentials.
2. Navigate to the http://localhost:8000/admin/manage and if it asks for admin login, use this credentials username doc211 and password 1111 to get access to admin panel.
3. Then navigate to http://localhost:8000/admin/manage-food.php page.
4. Prepare a local script named "exploit.php" containing basic test code: <?php phpinfo(); ?>
5. Upload the "exploit.php" file through the Update actions to update menu.
6. Identify the upload directory path using browser inspection tools.
7. Access the file directly by visiting its URL in the web browser (e.g., http://localhost:8000/images/food/Food-Name-6093.php).
8. Observe the executed PHP configuration page on the screen, verifying full Remote Code Execution.
|
|---|
| स्रोत | ⚠️ https://github.com/mwasikz/robo-cafe-rms |
|---|
| उपयोगकर्ता | dexter-morgan (UID 100687) |
|---|
| सबमिशन | 19/08/2026 11:49 PM (1 महीना पहले) |
|---|
| संयम | 28/09/2026 10:10 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 411165 [mwasikz robo-cafe-rms तक 228c44a02823f04e85db32b7137809a2856148fc manage-food.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|