CVE-2023-0943

MediumCVSS 4.7

Published: 21/02/2023(UTC)Updated: 19/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.27%

82th percentile - higher than 82% of all known CVEs

Summary

A problematic vulnerability in SourceCodester Best POS Management System 1.0, in the save_settings function of index.php?page=site_settings, Image Handler component. Manipulation of the img argument with ../../shell.php leads to unrestricted upload. The attack can be initiated remotely.

Risk Assessment

An attacker can upload malicious files to the server, potentially leading to remote code execution or system compromise.

Recommendation

Update the system or apply security patches that restrict file uploads and validate paths.

Other vulnerabilities in SourceCodester Best POS Management System

CVE-2023-0945Low
A vulnerability classified as problematic was found in SourceCodester Best POS Management System 1.0. An unknown function in the file index.php?page=add-category is affected. Manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross-site scripting. The attack can be launched remotely.

Original NVD description (English source)

A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_settings of the file index.php?page=site_settings of the component Image Handler. The manipulation of the argument img with the input ../../shell.php leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-221591.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS