PT-2019-16809 · Wallace · Wallacepos

Publicado 2019-07-31 · Atualizado 2019-08-06 · CVE-2019-3960

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WallacePOS version 1.4.3

Description The issue allows a remote, authenticated attacker to execute arbitrary code by uploading a malicious PHP file due to the unrestricted upload of files with dangerous types.

Recommendations For WallacePOS version 1.4.3, consider restricting file uploads to only allow safe file types and implement proper validation and sanitization of uploaded files to prevent the execution of arbitrary code.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-3960

Produtos afetados

Wallacepos

Referências · 3

• 🔥 https://tenable.com/security/research/tra-2019-37 · Exploit
• https://osv.dev/vulnerability/CVE-2019-3960 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3960 · Nota de Segurança