CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Upload a Web Shell to a Web Server.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.7.
Explanation of Vulnerability in Simple Terms
The Barcode Scanner with Inventory & Order Manager plugin allows authenticated administrators to upload files without proper validation. An attacker with admin credentials can upload malicious files to compromise the site's integrity, confidentiality, and availability. The vulnerability affects all versions up to 1.6.7. Update to a version newer than 1.6.7 when available.
What an attacker can do
Upload malicious files to the site and execute arbitrary code or modify site data.
Potential impact on your site
A compromised admin account can lead to full site takeover, data theft, or malware injection.
Conditions required to exploit
Attacker must have administrator-level access to the site.
Key dates
External resources
Related vulnerabilities
