CVE-2026-96556 Details

A vulnerability exists in Neethuharii CafeManagement version 1.0, specifically in the AddCashierCode.php file within the addcashier function. This flaw allows for improper authorization by manipulating the uname, pass, role, and status parameters. The vulnerability can be exploited remotely, leading to the creation of unauthorized administrative or cashier accounts. Notably, the application lacks any authentication or session management, leaving the entire administrative interface accessible to unauthenticated users.

It is recommended to implement server-side authentication and session management, ensuring that all administrative functions are protected by an authenticated admin session. Additionally, enforce server-side role validation to prevent the acceptance of client-supplied role data, and hash passwords using secure functions before storage, avoiding plaintext password storage.