High · published December 18, 2025
🚨 A disabled CSRF protection is an open invitation for attackers! An unauthenticated user can exploit this flaw, creating new admin accounts without ever logging in. ⚡ This vulnerability is like leaving a side door to your restaurant wide open while assuming no one will notice. Any sneaky individual can waltz in and start serving themselves — in this case, creating unauthorized administrator accounts! If an attacker successfully exploits this vulnerability, they could gain complete control of your point-of-sale system. This means they could access sensitive customer data, manipulate sales records, and even lock you out of your own system — utterly devastating!
This vulnerability is like leaving a side door to your restaurant wide open while assuming no one will notice. Any sneaky individual can waltz in and start serving themselves — in this case, creating unauthorized administrator accounts! This CSRF vulnerability in Open Source Point of Sale allows attackers to send unauthorized POST requests, since the CSRF protection mechanism was explicitly disabled in versions 3.4.0 to 3.4.2.
If an attacker successfully exploits this vulnerability, they could gain complete control of your point-of-sale system. This means they could access sensitive customer data, manipulate sales records, and even lock you out of your own system — utterly devastating! Upgrade to version 3.4.2 immediately to re-enable the CSRF filter in `app/Config/Filters.php`. As a temporary workaround, administrators can uncomment the protection line, but this should only be done if a full patch is on the table to avoid disruption in functionality. Don't wait! You've got this! Follow these steps, and you'll have that system locked down in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| opensourcepos/open_source_point_of_sale | ≥ 3.4.0, < 3.4.2 | 3.4.2 |