| 标题 | github Cafe Management System 1.0 Unauthenticated Arbitrary File Upload leading to Remote Code Exe |
|---|
| 描述 | Cafe Management System (CafeManagement) by Neethuharii, version 1.0 (latest commit f80fe4442d5e15af5c78df3f22177a131c1e6f32, no tagged release), is affected by an unauthenticated arbitrary file upload vulnerability that leads to remote code execution.
Affected file: AddProductCode.php (the identical flaw is also present in AddCashierCode.php and AddProduct_CashierPortalCode.php). Affected input: the multipart form-data parameter "image" together with "action=Add". No authentication or session check is performed on the handler, so the endpoint is reachable by an anonymous remote attacker.
Root cause: the upload routine derives the stored file extension directly from the client-supplied filename and writes the file into the web-accessible images/ directory without any validation:
$newfilename = "";
if(isset($_FILES['image']) && $_FILES['image']['error'] == 0){
$Image = $_FILES['image']['name'];
$tmp = explode(".", $Image);
$newfilename = round(microtime(true)) . '.' . end($tmp);
$uploadpath = "images/" . $newfilename;
move_uploaded_file($_FILES['image']['tmp_name'], $uploadpath);
}
There is no file-extension allow-list, no MIME/content validation (getimagesize/finfo), and no authentication. Because end(explode(".", $Image)) returns whatever extension the client sends, a file named shell.php is stored as images/<timestamp>.php (the name is round(microtime(true)) followed by the attacker-controlled extension) and is then executed by the PHP interpreter when requested. |
|---|
| 来源 | ⚠️ https://medium.com/@mr.yk404/unauthenticated-arbitrary-file-upload-leading-to-remote-code-execution-in-cafemanagement-df588b716e6f?sharedUserId=mr.yk404 |
|---|
| 用户 | Yashkumar Keral (UID 99903) |
|---|
| 提交 | 2026-07-20 17時44分 (2 月前) |
|---|
| 管理 | 2026-09-23 12時49分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 408919 [Neethuharii CafeManagement AddProductCode.php image 权限提升] |
|---|
| 积分 | 20 |
|---|