CVE-2018-17139

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

CVE-2018-17139

CVE-2018-17139 affects UltimatePOS 2.5. An arbitrary file upload vulnerability allows an attacker to upload files via the /products endpoint (content-type: image/jpeg) containing PHP code, enabling remote command execution. Evidence across CNVD-2018-19402 and NVD/NVD-derived entries confirms the ...