PT-2025-4650 · Ukrsolution · Ukrsolution Barcode Scanner With Inventory & Order Manager

L8Bl · Published 2025-01-21 · Updated 2025-01-21 · CVE-2025-22723

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UkrSolution Barcode Scanner with Inventory & Order Manager versions 1.6.7 and earlier

Description The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can potentially lead to the compromise of the web server.

Recommendations For UkrSolution Barcode Scanner with Inventory & Order Manager versions 1.6.7 and earlier, consider disabling the file upload feature until a patch is available to prevent potential exploitation. Restrict access to the web server to minimize the risk of compromise.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-22723

Affected Products

Ukrsolution Barcode Scanner With Inventory & Order Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-22723 · Security Note
• https://twitter.com/CVEnew/status/1881706669056442760 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1881741585823539267 · Twitter Post
• https://twitter.com/CveFindCom/status/1881711763869020349 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-and-inventory-manager-plugin-1-6-7-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-and-inventory-manager-plugin-1-6-7-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/15956 · Telegram Post