A vulnerability exists in the Environment Variable Handler component of Campcodes Complete POS Management and Inventory System, specifically affecting an undisclosed function in app/Http/Controllers/SettingsController.php. The flaw permits injection of malicious input, which can lead to the execution of unintended commands or alteration of critical environment settings. Because injection occurs in code that manages system configuration, an attacker may compromise the integrity of the application or gain unauthorized access to the underlying operating system. The vulnerability is classed as an injection weakness (CWE-707 and CWE-74) and could compromise confidentiality, integrity, and availability of the POS environment.

All installations of Campcodes Complete POS Management and Inventory System up to version 4.0.6 are impacted. The affected component is the SettingsController.php file within the Environment Variable Handler. Users of earlier versions are not affected.

The CVSS score for this issue is 5.3, reflecting moderate severity. An EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. However, the description states that exploitation can be performed remotely and that the exploit has been publicly disclosed. Likely attack vectors include sending crafted input to the SettingsController endpoint via an HTTP request, allowing unauthorized manipulation of environment variables or execution of injected code. Although the severity is moderate, the remote nature and public disclosure make it a significant risk worth addressing promptly.