opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

The core of this vulnerability lies in the deliberate disabling of CSRF protection within the Open Source Point of Sale application. This means that an attacker can craft a malicious web page that, when visited by a logged-in administrator, will automatically trigger actions as if the administrator initiated them. For example, an attacker could modify product prices, create fraudulent users with administrative privileges, or even delete critical data. The blast radius is significant, as a single compromised administrator account can grant an attacker control over the entire point-of-sale system. This vulnerability shares similarities with other CSRF exploits where inadequate input validation and authentication bypasses allow for unauthorized actions.

Organizations utilizing Open Source Point of Sale versions 3.4.0 through 3.4.1, particularly those with limited security expertise or those relying on default configurations, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as a compromise of one user's account could potentially impact others.

• linux / server: Monitor access logs for unusual POST requests originating from external sources. Look for patterns indicative of CSRF attacks, such as requests targeting administrative endpoints with unexpected parameters.

grep -i 'admin/.*POST.*' /var/log/apache2/access.log

• generic web: Use curl to test endpoints that require administrative privileges. Attempt to craft requests that modify data or perform actions without proper CSRF tokens.

curl -X POST -d 'param1=value1&param2=value2' https://your-pos-instance/admin/endpoint

• wordpress / composer / npm: While this vulnerability is not directly within WordPress, Composer, or npm, ensure that any plugins or modules interacting with the Open Source Point of Sale system are up-to-date and properly secured to prevent potential supply chain attacks.

1. 2025-12-17Disclosure

   disclosure

2. 2025-12-17Patch

   patch

1. Reservado2025-12-17
2. Publicada2025-12-17
3. Modificada2025-12-18
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-68434 is to immediately upgrade Open Source Point of Sale to version 3.4.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, review and restrict administrator access privileges to minimize the potential impact of a successful attack. Regularly audit user permissions and disable unnecessary accounts. While not a direct fix, enforcing strong password policies and multi-factor authentication can reduce the likelihood of an administrator account being compromised in the first place.