Description
A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_settings of the file index.php?page=site_settings of the component Image Handler. The manipulation of the argument img with the input ../../shell.php leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SourceCodester | Best POS Management System | 1.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload EDB-51280 · webapps · Apr 6, 2023 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VDB-221591 | SourceCodester Best POS Management System Image save_settings unrestricted upload vdb-entry technical-description
- VDB-221591 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required