Description
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument pic_filename results in path traversal. The attack may be launched remotely. The patch is identified as def0c27a0e252668df8d942fc31e16d1edfd7323. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opensourcepos Open Source Point of Sale
3.4.0affected3.4.1affected3.4.2affected
References
- https://vuldb.com/vuln/364435 ↗
- https://vuldb.com/vuln/364435/cti ↗
- https://vuldb.com/submit/802559 ↗
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-xq63-3v4g-39r5 ↗
- https://github.com/opensourcepos/opensourcepos/pull/4545 ↗
- https://github.com/opensourcepos/opensourcepos/commit/def0c27a0e252668df8d942fc31e16d1edfd7323 ↗