PT-2022-22217 · Unknown · Open Source Point Of Sale

Published 2022-07-28 · Updated 2022-08-04 · CVE-2022-34578

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale version 3.3.7

Description The issue is related to an arbitrary file upload vulnerability. This vulnerability can be exploited via the Update Branding Settings page.

Recommendations For Open Source Point of Sale version 3.3.7, consider restricting access to the Update Branding Settings page until a patch is available. As a temporary workaround, avoid using the branding settings update feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-34578

Affected Products

Open Source Point Of Sale

References · 5

• 🔥 https://grimthereaperteam.medium.com/open-source-point-of-sale-v3-3-7-file-upload-cross-site-scripting-4900d717b2c3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-34578 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34578 · Vendor Advisory
• https://t.me/cvenotify/33955 · Telegram Post
• https://t.me/cibsecurity/47246 · Telegram Post