Vitepos Point Of Sale Pos For Woocommerce
Monthly
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Blind SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce plugin, affecting all versions up to and including 3.6.1, lets an authenticated attacker with vendor-level access or higher inject arbitrary SQL through the src_by[].val.start and src_by[].val.end parameters when the 'bt' (BETWEEN) operator is used, allowing extraction of sensitive data from the WordPress database. The defect is an incomplete fix for a SQL injection patched in 3.6.0, which hardened only the gt/lt/le/ge operator branches and left the BETWEEN branch unescaped. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) reflects high confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis; this is a moderate-priority issue rather than an emergency, since exploitation requires a privileged vendor account and the blind nature of the injection makes data extraction slower and noisier.
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Blind SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce plugin, affecting all versions up to and including 3.6.1, lets an authenticated attacker with vendor-level access or higher inject arbitrary SQL through the src_by[].val.start and src_by[].val.end parameters when the 'bt' (BETWEEN) operator is used, allowing extraction of sensitive data from the WordPress database. The defect is an incomplete fix for a SQL injection patched in 3.6.0, which hardened only the gt/lt/le/ge operator branches and left the BETWEEN branch unescaped. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) reflects high confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis; this is a moderate-priority issue rather than an emergency, since exploitation requires a privileged vendor account and the blind nature of the injection makes data extraction slower and noisier.