A stored cross-site scripting vulnerability in Open Source Point of Sale v3.4.1 allows high-privileged attackers to inject arbitrary web scripts, posing a risk of session hijacking and data manipulation.

This vulnerability is a stored cross-site scripting flaw triggered when an authenticated user with high privileges submits malicious input through the phone_number parameter in the Create or Update Customer module. The application fails to properly sanitize this input, allowing arbitrary HTML or JavaScript to be executed within the context of the administrator session.

The exploitation of this vulnerability allows an attacker to execute arbitrary code in the browser of other administrative users, potentially leading to unauthorized data access, session theft, or the modification of critical POS records. With a CVSS score of 7.2, the impact is considered High due to the potential for total loss of integrity and confidentiality within the administrative interface.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the customer management module to trusted personnel only and implement strict input validation on the phone_number field.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing script tags or encoded characters directed toward customer update endpoints.

Compensating Controls: A Web Application Firewall (WAF) can be deployed with custom rules to inspect and block inputs containing common XSS vectors, such as script tags or event handlers, in the phone_number field.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher's GitHub repository.

Given the availability of a public proof-of-concept, organizations using OSPOS v3.4.1 must prioritize hardening their administrative access controls. Monitor vendor communications closely for an official security update and apply it immediately upon release to remediate the underlying sanitization flaw.