# CVE-2025-68434: Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…

Source: https://junglewise.ai/threats/cve-2025-68434-open-source-point-of-sale-opensourcepos-is-a-web-based-point-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-17  
License: CC BY 4.0 with a link back

CVE-2025-68434 · Severity: high · CVSS 8.8 · Published 2025-12-17

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's filter configuration. The CSRF protection mechanism was **explicitly disabled**, allowing the application to process state-changing requests (POST) without verifying a valid CSRF token. An unauthenticated remote attacker can exploit this by hosting a malicious web page. If a logged-in administrator visits this page, their browser is forced to send unauthorized requests to the application. A successful exploit allows the attacker to silently create a new Administrator account with full privileges, leading to a complete takeover of the system and loss of confidentiality, integrity, and availability. The vulnerability has been patched in version 3.4.2. The fix re-enables the CSRF filter in `app/Config/Filters.php` and resolves associated AJAX race conditions by adjusting token regeneration settings. As a workaround, administrators can manually re-enable the CSRF filter in `app/Config/Filters.php` by uncommenting the protection line. However, this is not recommended without applying the full patch, as it may cause functionality breakage in the Sales module due to token synchronization issues.

Technologies: [Opensourcepos Open Source Point of Sale](https://junglewise.ai/threats/technologies/open-source-point-of-sale). Vendors: [Opensourcepos](https://junglewise.ai/threats/vendors/opensourcepos).

## Quick answers

**Is CVE-2025-68434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68434 being exploited in the wild.

**How severe is CVE-2025-68434?** High severity, with a CVSS score of 8.8, published 17 December 2025.

**Which products and versions are affected?** Opensourcepos Open Source Point of Sale. The advisory does not name versions.

**Is there a fix for CVE-2025-68434?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-68434?** Check whether you run Opensourcepos Open Source Point of Sale. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Opensourcepos Open Source Point of Sale

## Related threats

- [OpenSourcePOS missing brute-force protection on login endpoint](https://junglewise.ai/threats/cve-2026-19895-opensourcepos-missing-brute-force-protection-on-login-endpoint)
- [opensourcepos Open Source Point of Sale path traversal in getPicThumb](https://junglewise.ai/threats/cve-2026-8802-opensourcepos-open-source-point-of-sale-path-traversal-in)
- [Open Source Point of Sale Stored XSS in Daily Sales table](https://junglewise.ai/threats/cve-2026-32712-open-source-point-of-sale-stored-xss-in-daily-sales-table)
- [Open Source Point of Sale Stored XSS in Stock Locations](https://junglewise.ai/threats/cve-2026-39380-open-source-point-of-sale-stored-xss-in-stock-locations)
- [Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…](https://junglewise.ai/threats/cve-2025-68147-open-source-point-of-sale-opensourcepos-is-a-web-based-point-of)