| 标题 | GitHub robo-cafe-rms 1.0 Unrestricted Upload |
|---|
| 描述 | An authenticated arbitrary file upload vulnerability exists in the Robo Cafe Restaurant Management System (robo-cafe-rms) version 1.0. The application's backend upload functionalities fail to validate file extensions or verify incoming MIME-types. An authenticated attacker can exploit this weakness by uploading a malicious PHP script disguised as an image for menu of food. Because the application saves files to a web-accessible public path, navigating directly to the destination folder triggers server-side execution of the script, leading to complete Remote Code Execution (RCE) on the host server.
PROOF OF CONCEPT (PoC) / REPRODUCTION STEPS:
1. Log into the robo-cafe-rms web application using administrative credentials.
2. Navigate to the http://localhost:8000/admin/manage and if it asks for admin login, use this credentials username doc211 and password 1111 to get access to admin panel.
3. Then navigate to http://localhost:8000/admin/manage-food.php page.
4. Prepare a local script named "exploit.php" containing basic test code: <?php phpinfo(); ?>
5. Upload the "exploit.php" file through the Update actions to update menu.
6. Identify the upload directory path using browser inspection tools.
7. Access the file directly by visiting its URL in the web browser (e.g., http://localhost:8000/images/food/Food-Name-6093.php).
8. Observe the executed PHP configuration page on the screen, verifying full Remote Code Execution.
|
|---|
| 来源 | ⚠️ https://github.com/mwasikz/robo-cafe-rms |
|---|
| 用户 | dexter-morgan (UID 100687) |
|---|
| 提交 | 2026-08-19 23時49分 (1 月前) |
|---|
| 管理 | 2026-09-28 22時10分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 411165 [mwasikz robo-cafe-rms 直到 228c44a02823f04e85db32b7137809a2856148fc manage-food.php 权限提升] |
|---|
| 积分 | 20 |
|---|