Executive Summary

CVE-2026-5561 is an authenticated Remote Code Execution (RCE) vulnerability in Campcodes Stocky POS version 4.0.6 and potentially earlier versions. It arises from insufficient sanitization in the backend API that updates system configurations, such as Twilio SMS settings. Specifically, user input is written directly into the root .env configuration file without properly handling newline characters, allowing an attacker to inject arbitrary environment variables.

By injecting newline characters within a JSON payload, an attacker can break out of the intended environment variable definition and override critical system variables like DUMP_PATH, which defines the executable path for the mysqldump utility. When an administrator triggers the 'Generate Backup' function, the application executes the poisoned DUMP_PATH variable via PHP's exec() function without proper escaping, enabling arbitrary OS command execution with web server privileges.

This vulnerability affects files such as app/Http/Controllers/SettingsController.php and app/Console/Commands/DatabaseBackUp.php in the Stocky POS system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full system compromise by allowing an authenticated attacker to execute arbitrary operating system commands with the privileges of the web server (e.g., Apache or Nginx).

• Unauthorized access to sensitive data.
• Data exfiltration through commands like certutil or curl.
• Potential takeover of the entire server hosting the POS system.
• Disruption of normal POS and inventory operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by verifying if unauthorized or suspicious commands are being executed on the system, especially related to the backup generation process. Monitoring HTTP requests to the Twilio configuration update endpoint for POST requests containing newline characters (\n) in the payload can indicate an injection attempt.

Additionally, inspecting active processes or security logs for execution of unusual commands such as certutil, curl, or whoami by the web server user (Apache/Nginx) can help detect exploitation.

• Check HTTP POST requests to the Twilio configuration update endpoint for payloads injecting newline characters.
• Monitor execution of system commands triggered by the backup generation function.
• Use commands like `ps aux | grep mysqldump` or `ps aux | grep certutil` to detect suspicious processes.
• Review web server logs for unusual command execution or outbound connections to attacker-controlled servers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Twilio configuration update endpoint to trusted administrators only and validating or sanitizing all user inputs to prevent injection of newline characters.

Avoid using unsanitized user input directly in environment variable files and system commands. Temporarily disabling the 'Generate Backup' function until a patch is applied can prevent exploitation.

• Restrict administrative access to configuration update endpoints.
• Implement input validation and sanitization to block newline characters in user input.
• Disable or restrict the backup generation feature until a secure patch is available.
• Monitor logs and system processes for signs of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated attacker to execute arbitrary operating system commands on the server hosting the Stocky POS system by injecting malicious environment variables. Such unauthorized access and potential data exfiltration could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access and breaches.

Specifically, the ability to execute commands with web server privileges may enable attackers to access, modify, or exfiltrate sensitive customer or patient data stored or processed by the system, thereby compromising confidentiality and integrity requirements mandated by these standards.

Organizations using the affected software must consider this vulnerability a significant risk to compliance and take appropriate mitigation steps to prevent potential regulatory penalties and reputational damage.

Useful 0 Not Useful 0