| Package | Affected versions | Patched versions |
|---|---|---|
| open source point of sale | = 3.4.1 |
OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free