Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality
Résumé
Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items search functionality. When the custom attribute search feature is enabled (search_custom filter), user-supplied input from the search GET parameter is interpolated directly into a HAVING clause without parameterization or sanitization. This allows an authenticated attacker with basic item search permissions to execute arbitrary SQL queries. A patch did not exist at the time of publication.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov