SourceCodester Best POS Management System Image save_settings unrestricted upload
CVE-2023-0943

8.8HIGH

Key Information:

Vendor
Sourcecodester
Status
Best Pos Management System
Vendor
CVE Published:
21 February 2023

Summary

An unrestricted upload vulnerability exists in the SourceCodester Best POS Management System 1.0, specifically impacting the save_settings function within the Image Handler component. This vulnerability allows an attacker to manipulate the img argument via the index.php?page=site_settings file to upload arbitrary files, such as shell scripts. The potential for remote exploitation poses significant risks, making it crucial for users to apply the necessary security measures and updates.

Affected Version(s)

Best POS Management System 1.0

References

https://vuldb.com/?id.221591
vdb-entrytechnical-description
https://vuldb.com/?ctiid.221591
signaturepermissions-required

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mroz1l (VulDB User)
.