Executive brief
Open Source Point of Sale is a web-based system used by businesses to manage sales, inventory, and employees. A security flaw allows an attacker with basic account access to inject malicious scripts into the system's stock location settings. When other staff members view the employee management interface, these scripts could automatically run, potentially allowing the attacker to steal login credentials or perform unauthorized actions on behalf of other users.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Open Source Point of Sale (OSPOS) prior to version 3.4.3. The vulnerability is located in the Stock Locations configuration feature, specifically within the 'stock_location' parameter of the '/config/saveLocations' endpoint. The application fails to sanitize user input before storing it in the database and subsequently fails to escape the data when rendering it in 'app/Views/employees/form.php'. An attacker with low-level privileges can inject a payload that executes when an administrative user views the Employees interface. This can lead to session hijacking, unauthorized actions, or phishing. The issue is resolved in version 3.4.3 by implementing proper output escaping using the esc() helper or htmlspecialchars.
Affected products
- opensourcepos Open Source Point of Sale < 3.4.3
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched