Simple POS System CVE-2026-9445

Authentication to the admin panel is required - the CVSS PR:L (Low Privileges) vector confirms that a valid account with access to the /admin/ section must be obtained before exploitation is possible; unauthenticated remote exploitation is not supported by the available data. The vulnerable /admin/addproduct.php endpoint must be network-accessible, and the product image upload feature must be active (appears to be default functionality). For maximum impact (remote code execution via web shell), the web server must permit PHP or script execution within the upload directory - if execution is disabled in the upload path, the uploaded file can be stored but not triggered. SSVC Automatable: no is consistent with the authentication prerequisite limiting mass scanning attacks. The flaw affects only version 1.0 of the application; no other versions are confirmed affected.

The CVSS 4.0 base score of 2.1 (Low) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L reflects network-reachable exploitation requiring low privilege and no user interaction, but with only partial confidentiality, integrity, and availability impact and no scope change to secondary systems. This low numerical score is potentially misleading for a CWE-434 flaw - unrestricted upload vulnerabilities routinely enable full remote code execution if upload directories permit script execution, which would imply higher real-world impact than the partial scoring suggests. SSVC rates Technical Impact as partial and Automatable as no, consistent with the authentication barrier (PR:L). EPSS at 0.04% (11th percentile) and absence from CISA KEV indicate low current exploitation probability, though the publicly available POC on GitHub lowers the barrier for opportunistic attackers. The discrepancy between the low CVSS score and the serious potential of CWE-434 should be noted: defenders should evaluate whether the actual server configuration permits PHP execution in the upload path, as that determines real-world severity.

An attacker who has obtained valid low-privileged admin credentials - through phishing, credential stuffing, or brute force against the admin panel - navigates to /admin/addproduct.php and submits a product creation request with a PHP web shell renamed to bypass any client-side extension checks, uploading it via the image parameter. A public proof-of-concept demonstrating this exact technique is available at the GitHub gist referenced in the CVE. If the upload directory permits PHP execution, the attacker then requests the uploaded file's URL directly, gaining an interactive shell on the server under the web server process account.