Open Source POS CVE-2025-68147

Exploitation requires an attacker to have write access to the 'Store Configuration' area of OSPOS - i.e. administrator-level privileges (per PR:H), obtained legitimately as a rogue admin or via a compromised/CSRF-abused admin account. The specific injection point is the 'Return Policy' configuration field, which is rendered unescaped by the receipt (receipt_default.php) and invoice email (invoice_email.php) templates. Execution additionally requires user interaction (UI:R): a victim - staff member or administrator - must view a receipt or complete a transaction for the stored payload to run in their browser. Limiting factors that reduce realistic risk: the privileged write prerequisite, the dependence on a victim actually rendering a receipt, and the temporary mitigation of restricting the field to plain text. Affected versions are 3.4.0 up to (not including) 3.4.2.

This is a stored XSS (CWE-79) in OSPOS whose CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N = 8.1 High) is driven up primarily by the scope change (S:C) and the high confidentiality/integrity impact on victim sessions, NOT by ease of initial access. The critical qualifier is PR:H: injecting the payload requires access to 'Store Configuration,' i.e. an administrator-level account (or an account hijacked via the separately-referenced CSRF flaw). This substantially lowers real-world urgency versus an unauthenticated XSS - the attacker must already be a rogue/compromised admin. A public POC exists (publicly available exploit code exists), and a vendor patch is available, but the vulnerability is NOT in CISA KEV (no confirmed active exploitation) and no EPSS score was provided in the input, so widespread opportunistic exploitation cannot be inferred. SSVC framing: exploitation is 'poc,' automatable is effectively 'no' (requires privileged configuration write plus a victim viewing a receipt), and technical impact is 'total' only against the victim's session scope. Net: a genuine privilege-escalation/lateral-movement risk inside an already-trusted admin boundary rather than a drive-by internet threat - a moderate real-world priority despite the 8.1 score. Note signal tension: POC availability is present but must not be conflated with active exploitation, which is unconfirmed.

A rogue administrator, or an attacker who has compromised an admin account (potentially chaining the separate CSRF issue), opens Store Configuration and enters a malicious JavaScript payload into the 'Return Policy' field. The payload is stored unescaped and later executes in the browser of any staff member or other administrator who views a receipt or completes a transaction, enabling session hijacking or actions on the victim's behalf. A public proof-of-concept is available (Nixon-H GitHub repo and the GHSA advisory).