PT-2022-25327 · Php Point Of Sale Llc+1 · Php Point Of Sale

Edward Prior · CVE-2022-40291 · Published 2022-10-31 · Updated 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The application is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This allows an attacker to coerce users into sending malicious requests to the site, potentially leading to account deletion or, in rare cases, account hijacking and the creation of additional admin accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-40291

Affected Products

Php Point Of Sale

References · 4

• https://osv.dev/vulnerability/CVE-2022-40291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40291 · Security Note
• https://themissinglink.com.au/security-advisories/cve-2022-40291 · Note
• https://t.me/cibsecurity/52328 · Telegram Post