Executive Summary

This vulnerability exists in Open Source Point of Sale 3.4.1 where the password change endpoint allows users to set their password to an empty string because the server does not validate the password fields properly. If an authenticated user submits a password change request with empty 'password' and 'repeat_password' parameters, the system accepts it and sets the password to empty, effectively disabling authentication for that account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized access to user or administrative accounts by disabling their passwords. Attackers or malicious users could exploit this to gain access without needing a valid password, potentially compromising sensitive data or system control.

Useful 0 Not Useful 0