This vulnerability in Neethuharii CafeManagement involves improper authorization in the addcashier function of AddCashierCode.php. By manipulating input parameters such as uname, pass, role, and status, an attacker can bypass authorization controls remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The vendor was notified but did not provide a response or patch. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized actions related to cashier addition or management, potentially leading to privilege escalation or unauthorized access within the application. The impact is limited to the scope of the addcashier function and the privileges it controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing compensating controls such as restricting access to the affected function, monitoring for suspicious activity related to cashier management, and applying web application firewalls to detect and block exploit attempts.