CVE-2025-10065
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into the itsourcecode POS Point of Sale System 1.0 through the /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php file. When exploited, it enables cross-site scripting attacks that can steal session cookies, redirect users, or deface the application. Organizations using this specific POS system version are affected.
💻 Affected Systems
- itsourcecode POS Point of Sale System
📦 What is this software?
Point Of Sale System by Facebook Kimmymatillano
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full system access, compromise customer payment data, and install persistent backdoors.
Likely Case
Attackers inject malicious scripts to steal user session cookies, redirect users to phishing sites, or deface the application interface.
If Mitigated
With proper input validation and output encoding, the attack fails to execute malicious scripts, limiting impact to attempted exploitation logs.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories, making this easily exploitable by attackers with basic web application knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check vendor website for security updates
2. Apply any available patches
3. Verify the fix by testing the vulnerable endpoint
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement proper input validation and output encoding for the scripts parameter in the vulnerable PHP file
Modify /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php to sanitize user input
Web Application Firewall Rules
allDeploy WAF rules to block XSS payloads targeting the vulnerable endpoint
Add WAF rule: Block requests containing script tags or JavaScript in the scripts parameter
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to prevent script execution
- Restrict access to the vulnerable endpoint using network segmentation or authentication
🔍 How to Verify
Check if Vulnerable:
Test the /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php endpoint with XSS payloads in the scripts parameterCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that script injection attempts no longer execute and are properly sanitized📡 Detection & Monitoring
Log Indicators:
- HTTP requests to dom_data_th.php with script tags or JavaScript in parameters
- Unusual POST/GET parameters containing script payloads
Network Indicators:
- Traffic patterns showing repeated access to the vulnerable endpoint with encoded payloads
SIEM Query:
source="web_server" AND uri="*dom_data_th.php*" AND (param="*script*" OR param="*javascript*")