CVE-2022-40291

CVE-2022-40291 describes a Cross-Site Request Forgery (CSRF) vulnerability in phppointofsale's php_point_of_sale application. This flaw allows an attacker to trick users into executing malicious requests, potentially leading to account deletion or, in rare cases, full account hijacking and the creation of unauthorized administrator accounts. Rated with a CVSS score of 8.8 (HIGH), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, requiring user interaction. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.