This vulnerability in RafyMrX TOKO-ONLINE-ROTI involves an authorization bypass caused by improper validation of the kd_cs argument in the proses/add.php file. Exploitation can be performed remotely without user interaction or elevated privileges. Due to the rolling release model, no specific affected or patched versions are identified. The vendor has not issued any advisory or patch, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to bypass authorization mechanisms remotely, potentially granting unauthorized access or actions within the application. The impact is rated medium based on the CVSS 4.0 score of 5.3. No further details on specific consequences or data exposure are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a fix is released, consider restricting access to the vulnerable functionality or implementing additional access controls as a temporary measure.