Unauthenticated code execution via unrestricted image upload

Unrestricted file upload in Neethuharii CafeManagement allows remote attackers to execute code through AddProductCode.php's image field. The handler preserves the client-supplied extension, builds an images/ path, and calls move_uploaded_file without checking the file type or contents. No authentication check is present in the handler, so an uploaded PHP file can execute with the web server's privileges when requested from the web-accessible images directory.