Neethuharii CafeManagement AddProductCode.php image unrestricted upload

Summaryinfo

A vulnerability was found in Neethuharii CafeManagement. It has been rated as critical. Impacted is an unknown function of the file AddProductCode.php. This manipulation of the argument image causes unrestricted upload. The identification of this vulnerability is CVE-2026-96513. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability has been found in Neethuharii CafeManagement and classified as critical. Affected by this vulnerability is an unknown function of the file AddProductCode.php. The manipulation of the argument image with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability.

It is possible to read the advisory at medium.com. This vulnerability is known as CVE-2026-96513. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

It is possible to download the exploit at medium.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way. By approaching the search of inurl:AddProductCode.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Neethuharii

Name

• CafeManagement

Version

• 5f743043a9a04f903678697f061d2e220e544c09
• 66c837020e25af4866cb69b23ec3af4e0e1510c9
• f80fe4442d5e15af5c78df3f22177a131c1e6f32

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #897619: github Cafe Management System 1.0 Unauthenticated Arbitrary File Upload leading to Remote Code Exe (by Yashkumar Keral)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion