PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks. The attacker must have shell access to the device in order to exploit this vulnerability.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Link | Tags |
|---|---|
| https://ppn.paxengine.com/release/development | vendor advisory permissions required |
| https://blog.stmcyber.com/pax-pos-cves-2023/ | third party advisory exploit technical description |
| https://cert.pl/en/posts/2024/01/CVE-2023-4818/ | third party advisory |
| https://cert.pl/posts/2024/01/CVE-2023-4818/ | third party advisory |