The vulnerability is located in CafePortalLogin.php of the CafeManagement application, where the uname argument can be manipulated to inject SQL code, resulting in a classic SQL injection flaw (CWE-74 and CWE-89). An attacker can supply a crafted uname value that alters the authentication query, enabling the bypass of password checks and gaining unauthorized access to the application without credentials. The impact is strictly the loss of authentication integrity, potentially exposing protected sections of the app to an unauthenticated user.

The affected product is Neethuharii CafeManagement. The flaw resides in the Login Handler component, specifically the CafePortalLogin.php file. Because the vendor employs a rolling release model, no specific version numbers are available; all current releases are considered potentially vulnerable until an official fix is released.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to the /CafePortalLogin.php endpoint; an attacker can send a crafted uname value over HTTP from any internet‑connected location. Publicly available exploitation code exists, which raises the possibility of automated attacks.