CVE-2025-68434
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in Open Source Point of Sale (OSPOS) allows unauthenticated attackers to create administrator accounts when logged-in administrators visit malicious web pages. This affects all OSPOS installations running versions 3.4.0 through 3.4.1. Successful exploitation leads to complete system takeover.
💻 Affected Systems
- Open Source Point of Sale (OSPOS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attacker creates administrator account, gains full control over POS system, accesses sensitive customer/payment data, and disrupts business operations.
Likely Case
Attacker creates backdoor administrator account, accesses sales data, modifies pricing/inventory, and potentially exfiltrates payment information.
If Mitigated
With proper network segmentation and administrative access controls, impact limited to POS system only without lateral movement to other systems.
🎯 Exploit Status
Exploit requires social engineering to lure administrator to malicious page. No authentication required for attacker.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.2
Vendor Advisory: https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r
Restart Required: No
Instructions:
1. Backup your current installation and database. 2. Download version 3.4.2 from GitHub. 3. Replace all files except app/Config/ and app/Uploads/ directories. 4. Verify CSRF filter is enabled in app/Config/Filters.php.
🔧 Temporary Workarounds
Manual CSRF Filter Enable
allManually re-enable CSRF protection in configuration file
Edit app/Config/Filters.php and uncomment line: '$filters->aliases['csrf'] = \CodeIgniter\Filters\CSRF::class;'
🧯 If You Can't Patch
- Restrict administrative access to specific IP addresses only
- Implement web application firewall (WAF) with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check app/Config/Filters.php for CSRF filter line. If commented out or missing, system is vulnerable.Check Version:
Check app/Config/Constants.php for OSPOS_VERSION constant or view footer in web interfaceVerify Fix Applied:
Verify app/Config/Filters.php contains uncommented line: '$filters->aliases['csrf'] = \CodeIgniter\Filters\CSRF::class;'📡 Detection & Monitoring
Log Indicators:
- Unexpected administrator account creation
- POST requests to user management endpoints without CSRF tokens
- Multiple failed login attempts followed by successful admin creation
Network Indicators:
- HTTP POST requests to /users/create or similar endpoints without Referer header validation
- Cross-origin requests to administrative endpoints
SIEM Query:
source="web_logs" AND (uri_path="/users/create" OR uri_path="/users/save") AND NOT csrf_token=*🔗 References
- https://github.com/Nixon-H/CVE-2025-68434-OSPOS-CSRF-Unauthorized-Administrator-Creation
- https://github.com/opensourcepos/opensourcepos/commit/d575c8da9a1d7af8313a1e758e000e243f5614ef
- https://github.com/opensourcepos/opensourcepos/pull/4349
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r
- https://github.com/Nixon-H/CVE-2025-68434-OSPOS-CSRF-Unauthorized-Administrator-Creation
- https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-wjm4-hfwg-5w5r
