| 제목 | GitHub robo-cafe-rms 1.0 Unrestricted Upload |
|---|
| 설명 | An authenticated arbitrary file upload vulnerability exists in the Robo Cafe Restaurant Management System (robo-cafe-rms) version 1.0. The application's backend upload functionalities fail to validate file extensions or verify incoming MIME-types. An authenticated attacker can exploit this weakness by uploading a malicious PHP script disguised as an image for menu of food. Because the application saves files to a web-accessible public path, navigating directly to the destination folder triggers server-side execution of the script, leading to complete Remote Code Execution (RCE) on the host server.
PROOF OF CONCEPT (PoC) / REPRODUCTION STEPS:
1. Log into the robo-cafe-rms web application using administrative credentials.
2. Navigate to the http://localhost:8000/admin/manage and if it asks for admin login, use this credentials username doc211 and password 1111 to get access to admin panel.
3. Then navigate to http://localhost:8000/admin/manage-food.php page.
4. Prepare a local script named "exploit.php" containing basic test code: <?php phpinfo(); ?>
5. Upload the "exploit.php" file through the Update actions to update menu.
6. Identify the upload directory path using browser inspection tools.
7. Access the file directly by visiting its URL in the web browser (e.g., http://localhost:8000/images/food/Food-Name-6093.php).
8. Observe the executed PHP configuration page on the screen, verifying full Remote Code Execution.
|
|---|
| 원천 | ⚠️ https://github.com/mwasikz/robo-cafe-rms |
|---|
| 사용자 | dexter-morgan (UID 100687) |
|---|
| 제출 | 2026. 08. 19. PM 11:49 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 28. PM 10:10 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 411165 [mwasikz robo-cafe-rms 까지 228c44a02823f04e85db32b7137809a2856148fc manage-food.php 권한 상승] |
|---|
| 포인트들 | 20 |
|---|