CVE-2026-96514 Details
Description
A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
A SQL injection vulnerability has been identified in the Neethuharii CafeManagement application, specifically within the Login Handler component of the CafePortalLogin.php file. This vulnerability arises from the improper handling of the 'uname' parameter, which is directly concatenated into an SQL query without any sanitization or validation. As a result, an unauthenticated remote attacker can exploit this weakness to manipulate the SQL query, bypass authentication, and gain unauthorized access to user accounts. The application stores user passwords in plaintext, further exacerbating the security risk.
The application should be updated to use parameterized queries or prepared statements for SQL database interactions, particularly for user-supplied input. Additionally, passwords should be hashed before storage using secure hashing functions, and the application should implement a generic authentication failure response.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://medium.com/@mr.yk404/unauthenticated-sql-injection-leading-to-authentication-bypass-in-cafemanagement-php-e64abc2f52da | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-96514 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/897624 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408920 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408920/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Neethuharii CafeManagement | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |