This vulnerability affects Campcodes Complete POS Management and Inventory System up to version 4.0.6. It involves an injection flaw in the Environment Variable Handler component, located in app/Http/Controllers/SettingsController.php. The injection can be triggered remotely without user interaction and requires low privileges. The vulnerability has been publicly disclosed, but no official fix or patch has been confirmed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to inject malicious input remotely, potentially leading to unauthorized actions or data manipulation within the affected system. The impact is rated medium based on the CVSS score of 5.3, reflecting limited but non-negligible consequences. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been provided, organizations should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected system and applying any available compensating controls that limit exposure of the vulnerable component.