CVE-2023-0943: SourceCodester Best POS Management System Image save_settings unrestricted upload

Published Feb 21, 2023

Updated

A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects some unknown processing of the file index.php?page=sitesettings of the component Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.

Other sources

A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function savesettings of the file index.php?page=sitesettings of the component Image Handler. The manipulation of the argument img with the input ../../shell.php leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.

— MITRE

Affected Software

2 affected components

Best Pos Management System Project Best Pos Management System=1.0

Mayurik Best Pos Management System=1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Mitigate the VDB-221591 unrestricted upload by blocking or restricting HTTP requests that reach Image Handler endpoint index.php?page=site_settings and the img parameter, and prevent upload/creation of executable files (e.g., block .php uploads) at the web server and/or via a WAF/ACL.

Event History

Feb 21, 2023

CVE Published

via MITRE·07:59 PM

Data Sourced

via MITRE·07:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-0943?

CVE-2023-0943 is classified as problematic due to its potential for unrestricted file uploads.

How do I fix CVE-2023-0943?

To fix CVE-2023-0943, update to the latest version of the Best POS Management System that addresses this vulnerability.

What component is affected by CVE-2023-0943?

CVE-2023-0943 affects the Image Handler component of the Best POS Management System.

What type of vulnerability is CVE-2023-0943?

CVE-2023-0943 is a file upload vulnerability that allows attackers to upload arbitrary files.

Which file is involved in CVE-2023-0943?

The vulnerability is related to the manipulation of the file index.php?page=site_settings.