CVE-2026-39380: Open Source POS Stored XSS Vulnerability

CVE-2026-39380 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Open Source Point of Sale (OSPOS), a web-based point-of-sale application written in PHP using the CodeIgniter framework. Prior to version 3.4.3, the application fails to properly sanitize user input supplied through the stock_location parameter in the Stock Locations configuration feature, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the browsers of other users viewing the Employees interface, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.

Affected Products

• Open Source Point of Sale (OSPOS) versions prior to 3.4.3
• Web deployments using the vulnerable Stock Locations configuration feature
• Systems where the Employees interface renders unsanitized stock location data

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-39380 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39380

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists in the Stock Locations configuration feature of Open Source Point of Sale. The root issue lies in the application's failure to implement proper input validation and output encoding for user-supplied data in the stock_location parameter. When an authenticated user with access to the Stock Locations configuration submits a malicious payload, the application stores this unsanitized input directly in the database.

The stored payload is subsequently rendered without proper encoding when the data is displayed in the Employees interface, causing the malicious JavaScript to execute in the context of any user's browser session who views that interface. This represents a persistent attack vector since the malicious code remains in the database until explicitly removed.

Root Cause

The vulnerability stems from insufficient input sanitization and lack of output encoding in the CodeIgniter-based application. The stock_location parameter accepts arbitrary user input without filtering potentially dangerous HTML or JavaScript content. Additionally, when this data is retrieved from the database and rendered in the Employees interface views, the application fails to apply proper HTML entity encoding, allowing the stored script tags to be interpreted and executed by the browser.

Attack Vector

An attacker with authenticated access to the Stock Locations configuration feature can exploit this vulnerability by injecting JavaScript code into the stock_location field. The attack follows these steps:

1. The attacker authenticates to the OSPOS application with sufficient privileges to access Stock Locations configuration
2. A malicious JavaScript payload is submitted through the stock_location parameter
3. The application stores the payload in the database without sanitization
4. When any user (including administrators) accesses the Employees interface, the malicious script executes in their browser
5. The attacker can leverage the executed script to steal session cookies, perform actions as the victim, or redirect users to malicious sites

The vulnerability requires user interaction (UI:R) as a victim must navigate to the affected interface for the payload to execute. Due to the changed scope (S:C), the vulnerability can impact resources beyond the vulnerable component's security scope.

Detection Methods for CVE-2026-39380

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in stock location database records
• Unexpected script execution or browser behavior when accessing the Employees interface
• Session hijacking attempts or unauthorized administrative actions following Employees page access
• Database entries containing encoded or obfuscated script tags in stock location fields

Detection Strategies

• Implement web application firewall (WAF) rules to detect XSS payloads in POST parameters targeting Stock Locations endpoints
• Review database records in stock location tables for HTML tags, script elements, or encoded JavaScript
• Monitor application logs for suspicious form submissions containing special characters or script syntax
• Deploy browser-based XSS detection mechanisms that alert on unexpected script execution

Monitoring Recommendations

• Enable detailed logging for all Stock Locations configuration changes with user attribution
• Implement Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Set up alerts for database modifications to stock location records containing HTML special characters
• Monitor for abnormal session behavior following Employees interface access

How to Mitigate CVE-2026-39380

Immediate Actions Required

• Upgrade Open Source Point of Sale to version 3.4.3 or later immediately
• Audit existing database records for malicious payloads in stock location fields
• Review user access logs for suspicious activity related to Stock Locations configuration
• Implement Content Security Policy headers as an additional defense layer

Patch Information

The vulnerability has been fixed in Open Source Point of Sale version 3.4.3. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to the Stock Locations configuration feature to only trusted administrators until patching is complete
• Implement server-side input validation to strip or encode HTML special characters in the stock_location parameter
• Deploy a Web Application Firewall (WAF) with XSS detection rules to block malicious payloads
• Sanitize existing database records by removing or encoding any HTML or JavaScript content in stock location fields

# Example database cleanup query to identify potentially malicious records
# Review results manually before any modifications
mysql -u [username] -p [database] -e "SELECT * FROM stock_locations WHERE location_name REGEXP '<[^>]*script|javascript:|on[a-z]+=' ;"