CVE-2025-68658: Open Source POS Stored XSS Vulnerability

CVE-2025-68658 Overview

CVE-2025-68658 is a stored Cross-Site Scripting (XSS) vulnerability affecting Open Source Point of Sale (opensourcepos), a web-based point of sale application written in PHP using the CodeIgniter framework. The vulnerability exists in the Configuration (Information) functionality, where an authenticated user with the "Configuration: Change OSPOS's Configuration" permission can inject malicious JavaScript payloads into the Company Name field. Due to insufficient input validation and output encoding, the injected script persists in the database and executes when any user accesses the /sales/complete endpoint.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in other users' browsers, potentially leading to session hijacking, credential theft, and unauthorized actions within the point of sale system.

Affected Products

• Open Source Point of Sale (opensourcepos) version 3.4.0
• Open Source Point of Sale (opensourcepos) version 3.4.1

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68658 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68658

Vulnerability Analysis

This stored XSS vulnerability occurs when processing user-supplied input in the Configuration module of opensourcepos. An authenticated user with elevated configuration permissions can inject arbitrary JavaScript code into the Company Name field through the Information settings. The application fails to properly sanitize this input before storing it in the database and subsequently fails to encode the output when rendering the data on the sales completion page.

The attack requires authentication and specific permissions, which limits the attack surface. However, once the payload is stored, it affects all users who access the /sales/complete endpoint, making this a one-to-many attack scenario particularly dangerous in multi-user retail environments.

Root Cause

The root cause is insufficient input validation and missing output encoding in the Configuration module. When updating the Company Name field in the Information section, the application accepts raw user input without sanitizing HTML or JavaScript content. Subsequently, when this data is displayed on the sales completion page, it is rendered without proper HTML entity encoding, allowing the injected script to execute in the context of the victim's browser session.

Attack Vector

The attack leverages the network-based attack vector and requires the attacker to have authenticated access with configuration change permissions. The exploitation sequence involves:

1. The attacker authenticates to opensourcepos with an account that has "Configuration: Change OSPOS's Configuration" permission
2. The attacker navigates to the Configuration section and selects Information settings
3. A malicious JavaScript payload is entered into the Company Name field
4. When any user accesses the Sales module and navigates to /sales/complete (by selecting Sales, creating a New Item, and clicking Completed), the stored payload executes in their browser

The attack does not require user interaction beyond normal application usage, making it effective against any user who performs routine sales operations. The stored nature of the XSS means the payload persists until the Company Name field is modified, allowing for ongoing exploitation.

Detection Methods for CVE-2025-68658

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in the Company Name configuration field
• Unexpected script execution or browser alerts when accessing the /sales/complete endpoint
• Audit logs showing modifications to Configuration settings with suspicious payloads containing <script>, onerror=, onload=, or similar event handlers
• User reports of unexpected browser behavior or redirects when completing sales transactions

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests to configuration endpoints
• Enable Content Security Policy (CSP) headers to restrict inline script execution and report policy violations
• Deploy application-level logging to capture all configuration changes with full payload details for forensic analysis
• Use browser-based XSS auditors and security extensions to detect script injection attempts during testing

Monitoring Recommendations

• Monitor database tables storing configuration values for suspicious entries containing script tags or JavaScript event handlers
• Review application access logs for repeated access patterns to /sales/complete following configuration changes
• Implement real-time alerting on configuration modifications, particularly to display-related fields like Company Name
• Conduct periodic security scans of stored application data to identify potentially malicious content

How to Mitigate CVE-2025-68658

Immediate Actions Required

• Upgrade opensourcepos to version 3.4.2 or later, which contains the fix for this vulnerability
• Review and audit the Company Name field and other configuration values for any existing malicious payloads
• Restrict "Configuration: Change OSPOS's Configuration" permissions to only trusted administrative users
• Implement Content Security Policy headers to mitigate the impact of any undetected stored XSS payloads

Patch Information

The vulnerability has been fixed in opensourcepos version 3.4.2. The fix is available through the GitHub commit 849439c, which addresses the input validation and output encoding deficiencies. Additional details about the vulnerability and remediation can be found in the GitHub Security Advisory GHSA-32r8-8r9r-9chw.

Organizations should apply the update as soon as possible, particularly those running opensourcepos versions 3.4.0 or 3.4.1 in production environments.

Workarounds

• Implement strict input validation on the Company Name field using server-side sanitization to strip HTML and JavaScript content
• Apply output encoding using PHP's htmlspecialchars() or CodeIgniter's built-in XSS filtering on all configuration values before rendering
• Deploy a Web Application Firewall (WAF) with XSS detection rules to filter malicious payloads
• Limit configuration change permissions to a minimal set of highly trusted administrators until the patch is applied

# Configuration example - Enable CodeIgniter's global XSS filtering
# In application/config/config.php, set:
$config['global_xss_filtering'] = TRUE;

# Additionally, ensure CSP headers are set in your web server configuration
# Apache example in .htaccess:
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"