CVE-2022-40294

Published Oct 31, 2022

Last updated a year ago

Overview

Description: The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within export data and then triggered in exported data viewers.
Source: vdp@themissinglink.com.au
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-1236
vdp@themissinglink.com.au: CWE-1236

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:phppointofsale:php_point_of_sale:19.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7CE86DBF-3841-4144-B646-FB22C2E12758"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References