CVE-2023-0943

🗓️ 21 Feb 2023 19:59:38Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 75 Views🌐 WEB

Vulnerability in SourceCodester Best POS Management System 1.0 allows remote attackers to initiate unrestricted upload via manipulation of index.php?page=site_settings in Image Handler component (CVE-2023-0943)

Reporter	Title	Published	Views	Family All 11
0day.today	Best pos Management System v1.0 - Remote Code Execution on File Upload Vulnerability	6 Apr 202300:00	–	zdt
Circl	CVE-2023-0943	21 Feb 202322:16	–	circl
CNNVD	Best pos management system 代码问题漏洞	21 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-0943 SourceCodester Best POS Management System Image save_settings unrestricted upload	21 Feb 202319:59	–	cvelist
Exploit DB	Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload	6 Apr 202300:00	–	exploitdb
EUVD	EUVD-2023-12929	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0943	21 Feb 202320:15	–	nvd
OSV	CVE-2023-0943	21 Feb 202320:15	–	osv
Prion	Out-of-bounds	21 Feb 202320:15	–	prion
Positive Technologies	PT-2023-16629 · Sourcecodester · Sourcecodester Best Pos Management System	21 Feb 202300:00	–	ptsecurity

NVD

Vulners

Node

best_pos_management_system_project best_pos_management_systemMatch1.0

[
  {
    "vendor": "SourceCodester",
    "product": "Best POS Management System",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ],
    "modules": [
      "Image Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
img	request body	index.php?page=site_settings	Unrestricted upload via image handling function allows attacker to upload a PHP shell.	CWE-434
cmd	path	assets/uploads/1676627880_shell.png.php	Uploaded shell allows remote command execution via ?cmd= parameter.	CWE-434

21 Nov 2024 07:38Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.14.7 - 8.8

CVSS 25.8

CVSS 34.7

EPSS0.05813

CWE-434