An authenticated SQL injection vulnerability in Open Source Point of Sale versions 3.4.1 and earlier poses a significant risk of unauthorized data access and system compromise.

The application fails to sanitize user supplied input within the search_custom filter of the Items search functionality, leading to CWE-89 SQL Injection. An authenticated attacker with basic search permissions can inject malicious SQL commands directly into the database query structure.

This vulnerability carries a CVSS score of 8.8, indicating a high severity level that could lead to full database compromise, including the theft of sensitive customer or transaction data. Successful exploitation may result in unauthorized modification of records, loss of data integrity, and significant operational disruption to the point of sale environment.

Immediate Action: As no official patch is currently available, restrict access to the Items search functionality to trusted administrative users only and disable the custom attribute search feature if possible.

Proactive Monitoring: Review application and database logs for unusual SQL syntax patterns or unexpected query structures originating from the search functionality.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting GET parameters.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, organizations should treat this vulnerability as a high priority. Until a vendor-supplied patch is released, administrators must implement compensating controls such as WAF rules and strict access controls to minimize the attack surface.