High · published December 18, 2025
🚨 A stored XSS vulnerability in Open Source Point of Sale could let attackers inject malicious scripts without breaking a sweat! ⚡ Think of it like a mischievous guest slipping notes into the receipt printer, which gets handed out to everyone — only this time, those notes contain harmful content that can wreak havoc. With this vulnerability, an attacker could hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the victim, spreading chaos in the store environment. Imagine every time someone checks a receipt or completes a transaction, they're opening a door for the attacker to storm in and take control!
Think of it like a mischievous guest slipping notes into the receipt printer, which gets handed out to everyone — only this time, those notes contain harmful content that can wreak havoc. This vulnerability allows an attacker with access to the "Store Configuration" to save unsanitized JavaScript payloads to the database. When other users view the receipt, the malicious script is executed in their browser, leading to potential data theft and session hijacking.
With this vulnerability, an attacker could hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the victim, spreading chaos in the store environment. Imagine every time someone checks a receipt or completes a transaction, they're opening a door for the attacker to storm in and take control! Immediately upgrade to version 3.4.2, where the output is properly escaped using the `esc()` function. As a temporary measure, restrict the "Return Policy" field to plain text only, avoiding any HTML tags to minimize risk. You've got this! Follow these steps and you'll keep your POS system secure in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| opensourcepos/open_source_point_of_sale | ≥ 3.4.0, < 3.4.2 | 3.4.2 |