The vulnerability allows an attacker to manipulate the username, password, role, and status parameters when calling the addcashier function in AddCashierCode.php. This results in the creation of cashier accounts with arbitrary permissions, effectively bypassing the system’s access controls and enabling privilege escalation within the CafeManagement application.

The affected product is Neethuharii CafeManagement, as identified by the vendor and product name. No specific version information was supplied in the CVE data, so the risk applies to all installations of this application that have not applied a fix.

The CVSS score of 6.9 indicates a moderate severity vulnerability. Although the EPSS score is not available, the vulnerability is documented as exploitable and a public exploit exists, and the attack can be performed remotely. The vendor has not provided a patch, and the issue is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation remains non-negligible, and administrators should treat this as a high‑priority threat if the application is exposed to untrusted users.