CVE-2023-36348
HighCVSS 8.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
Version 2.0 of POS Codekop has an authenticated remote code execution (RCE) vulnerability via the filename parameter.
Risk Assessment
This vulnerability could allow attackers to execute arbitrary code on the server, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update POS Codekop to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in POS Codekop v2.0
See all- CVE-2023-36347High
A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.
- CVE-2023-36346Medium
Version 2.0 of POS Codekop was found to contain a reflected XSS vulnerability via the nm_member parameter in print.php.
- CVE-2023-36345High
A Cross-Site Request Forgery (CSRF) in POS Codekop v2.0 allows attackers to escalate privileges.
Original NVD description (English source)
POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.