CVE-2022-40296 Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.

Critical 9.8 Published 31 Oct 2022 Updated 6 May 2025

An attacker can exploit SSRF to force the server to interact with internal services, potentially compromising downstream systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-40296?

CVE-2022-40296 is a critical server-side request forgery vulnerability in PHP Point of Sale, published on 31 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.

Weakness: CWE-918

Which versions are affected by CVE-2022-40296?

It affects 1 product.

Products include Phppointofsale Php Point of Sale.

How do I fix CVE-2022-40296?

No fix has been published for CVE-2022-40296 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-40296 being exploited?

There is no known exploitation of CVE-2022-40296 in the wild and no public exploit code.

Sources

Also known as GHSA-xcfj-f8vp-729x.