Vulners
Lucene search
Shopy Point of Sale 1.0 - CSV Injection
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | Shopy Point of Sale v1.0 - CSV Injection Vulnerability | 25 Apr 201800:00 | – | zdt |
 | Shopy Point of Sale Command Injection Vulnerability | 3 May 201800:00 | – | cnvd |
 | CVE-2018-10258 | 1 May 201819:00 | – | cve |
 | CVE-2018-10258 | 1 May 201819:00 | – | cvelist |
 | EUVD-2018-2332 | 7 Oct 202500:30 | – | euvd |
 | Shopy Point of Sale 1.0 - CSV Injection | 25 Apr 201800:00 | – | exploitpack |
 | CVE-2018-10258 | 1 May 201819:29 | – | nvd |
 | Shopy Point Of Sale 1.0 CSV Injection | 26 Apr 201800:00 | – | packetstorm |
 | Input validation | 1 May 201819:29 | – | prion |
# Exploit Title: Shopy Point of Sale v1.0 - CSV Injection
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10258
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/shopy-point-of-sales/21730225
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]
Release Date:
=============
2018-04-23
Product & Service Introduction:
===============================
Point of sale for retail stores
Technical Details & Description:
================================
A user is able to inject a command that will be included in the exported CSV file.
Proof of Concept (PoC):
=======================
1. Login with Sales user's credentials
2. Browse to Trader > Customer > New Customer and add =cmd|'/C calc'!A1 into the Customer Name field
3. Log in with admin's credentials
4. Browse to Sales > Create Invoice to create an invoice for that user
5. Browse to All Invoice > Export to download and open the exported CSV file
==================Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Apr 2018 00:00Current
8.9High risk
Vulners AI Score8.9
CVSS 26.5
CVSS 38.8
EPSS0.02613