CVE-2022-44400

CVE-2022-44400 affects Purchase Order Management System v1.0. The vulnerability is an unrestricted file upload exposed at /purchase_order/admin/?page=system_info, described as a file upload vulnerability. CVSS v3.1 metrics indicate a CRITICAL impact (C/H, I/H, A/H) with NETWORK attack vector, LOW...

Admin can drain user funds from the Pool or buy assets for free

Lines of code Vulnerability details Impact We assume that the admin is honest, however there is still possibility of exploiting asset policy contract to and set price to 0 in oder to buy an asset for free - or even worse - drain user funds by setting the price really high in...

The attacker can steal the ETH of users that wanted to buy an NFT by sandwiching the victim transaction.

Lines of code Vulnerability details Impact The attacker can steal the ETH of users that wanted to buy an NFT by sandwiching the victim transaction. Proof of Concept In non-atomic some of the orders could fail and funds should return and the end of execute function - . But the returnETHIfAny...

PT-2022-24565 · Maxon · Maxon Erp

Name of the Vulnerable Software and Affected Versions: Maxon ERP affected versions not specified Description: A critical vulnerability has been found in Maxon ERP, affecting the file /index.php/purchase order/browse data. The manipulation of the tb search argument leads to SQL injection. It is...

CVE-2022-43081

Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php...

CVE-2022-43082

A cross-site scripting XSS vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the customer parameter...

PT-2022-26744 · Unknown · Fast Food Ordering System

Name of the Vulnerable Software and Affected Versions: Fast Food Ordering System version 1.0 Description: A cross-site scripting XSS issue exists in the /fastfood/purchase.php endpoint of the Fast Food Ordering System, allowing attackers to execute arbitrary web scripts or HTML via a crafted...

Fast Food Ordering System 跨站脚本漏洞

Fast Food Ordering System is a fast food ordering system by the individual developer Carlo Montero. A security vulnerability exists in Fast Food Ordering System v1.0, which originates from a cross-site scripting XSS vulnerability contained in /fastfood/purrchase. An attacker could use this...

PT-2022-26743 · Unknown · Fast Food Ordering System

Name of the Vulnerable Software and Affected Versions: Fast Food Ordering System version 1.0 Description: The issue is related to a SQL injection vulnerability. It affects the /fastfood/purchase.php component. Recommendations: For Fast Food Ordering System version 1.0, consider restricting access...

CVE-2022-3503

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

CVE-2022-3503

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

Cross site scripting

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

PT-2022-22509 · Sourcecodester · Sourcecodester Purchase Order Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Purchase Order Management System version 1.0 Description: A vulnerability was found in the Supplier Handler component, where the manipulation of the Supplier Name, Address, Contact person, or Contact argument leads to cross-sit...

CVE-2022-3503 SourceCodester Purchase Order Management System Supplier cross site scripting

A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site...

CVE-2022-3503

CVE-2022-3503 affects SourceCodester Purchase Order Management System 1.0, specifically the Supplier Handler component. The vulnerability is a cross-site scripting (XSS) flaw caused by manipulating the arguments Supplier Name/Address/Contact person/Contact, which can be exploited remotely. The ex...

Purchase Order Management System 跨站脚本漏洞

Purchase Order Management System is a purchase order management system developed by Carlo Montero. A security vulnerability exists in Purchase Order Management System version 1.0, which is a cross-site scripting vulnerability caused by manipulation of the parameter "page"...

Purchase Order Management System 安全漏洞

Purchase Order Management System is a purchase order management system developed by Carlo Montero. A security vulnerability exists in Purchase Order Management System version 1.0, which is a cross-site scripting vulnerability caused by incorrect manipulation of the parameter "Name/Address/Contact...

Purchase Order Management System SQL注入漏洞

Purchase Order Management System is a purchase order management system by Carlo Montero, an individual developer. A security vulnerability exists in Purchase Order Management System version 1.0, which is caused by a sql injection due to manipulation of the parameter id...

Buyer can receive chargeback from fees.

Lines of code Vulnerability details Impact Since there is no check on who the fees.recipient is in the sell order, the buyer could be the fees recipient, with some additional signature malleability to pass the signature validation, the buyer would receive fees, thus pay less for the NFT. Proof of...

The delegation even if you have no VotingPower

Lines of code Vulnerability details Impact when you buy a new VotingPower. You need to undelegated them before the next proposal Proof of Concept -When Alice sell his NFT by calling transferFrom on PartyGovernanceNFT.sol. it will be set for the delegating to the previous delegator. but he actuall...