CVE-2026-33730 Open Source POS IDOR 漏洞，已修复

openSourcePOS 在 3.4.2 版本之前的存在 IDOR（不安全的直接对象引用）漏洞，允许经过身份验证的低权限用户通过操纵 employee_id 参数来访问和修改其他用户（包括管理员）的密码更改功能。应用程序不验证对象所有权或强制执行授权检查。这可能导致攻击者获得对管理员帐户的控制权，从而可能破坏整个销售点系统和敏感数据。由于未经授权的访问和数据泄露的潜在影响，此漏洞的影响非常大。

Organizations utilizing Open Source Point of Sale versions 3.4.2 and earlier, particularly those with multiple user accounts and administrator privileges, are at risk. Shared hosting environments where multiple POS systems share the same server infrastructure could also be impacted, as a compromise of one system could potentially lead to the compromise of others.

• codeigniter: Examine application logs for suspicious requests manipulating the employee_id parameter.

grep 'employee_id=' /var/log/apache2/access.log

• generic web: Monitor access logs for unusual patterns of requests targeting the password change endpoint with varying employee_id values.

curl -v 'http://your-pos-system/password_reset.php?employee_id=1' # Test with different IDs

• generic web: Check response headers for any signs of unauthorized access or privilege escalation.

curl -I 'http://your-pos-system/password_reset.php?employee_id=1' # Check status code and headers

1. 2026-03-27Disclosure

   disclosure

1. 已保留2026-03-23
2. 发布日期2026-03-27
3. EPSS 更新日期2026-04-03

推荐的缓解措施是将 openSourcePOS 升级到 3.4.2 或更高版本。此版本引入了对象级别的授权控制，从而有效地防止未经授权的访问。此外，强烈建议为管理员帐户实施多因素身份验证 (MFA)，并定期审查用户权限。应进行定期渗透测试以主动识别和解决潜在的安全漏洞。快速修补对于最大限度地减少利用风险至关重要。