CVE-2026-9445 Details

A vulnerability allowing unrestricted file uploads has been identified in SourceCodester Simple POS and Inventory System version 1.0. The issue resides in the file '/admin/addproduct.php', where the 'image' parameter is manipulated to bypass file extension restrictions. This flaw enables remote exploitation by uploading malicious files, such as PHP web shells, which can be executed on the server.

Users are advised to implement prepared statements to prevent SQL injection, enhance file validation by checking MIME types and maintaining a strict allowlist, randomize filenames of uploaded files, restrict upload permissions to prevent PHP execution in the upload directory, and store uploaded files in a location not accessible from the web.