CVE-2026-26745
Second-Order SQL Injection in OpenSourcePOS 3.4.1 Configuration
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opensourcepos | open_source_point_of_sale | 3.4.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a second order SQL Injection found in OpenSourcePOS version 3.4.1. It occurs in the handling of the currency_symbol configuration field. Although the input for this field is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This flaw allows an attacker who can modify the currency_symbol value to inject arbitrary SQL code, which will be executed when the affected query runs.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with the ability to modify the currency_symbol configuration to execute arbitrary SQL commands on the database. This could lead to unauthorized data access, data modification, or even deletion of critical data. It may also enable attackers to escalate privileges or compromise the integrity and confidentiality of the system's data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves checking if the currency_symbol configuration field in OpenSourcePOS 3.4.1 has been modified with potentially malicious SQL code. Since the vulnerability is a second order SQL Injection, the malicious payload is stored first and executed later in a dynamically constructed SQL query.'}, {'type': 'paragraph', 'content': 'You can detect signs of exploitation by inspecting the currency_symbol value in the application configuration database or files for suspicious SQL syntax or unexpected characters.'}, {'type': 'paragraph', 'content': 'Commands to help detect this might include querying the database directly to view the currency_symbol field, for example using SQL commands like:'}, {'type': 'list_item', 'content': 'SELECT currency_symbol FROM configuration_table;'}, {'type': 'paragraph', 'content': "Replace 'configuration_table' with the actual table name used by OpenSourcePOS to store configuration settings."}, {'type': 'paragraph', 'content': 'Additionally, monitoring logs for unusual SQL errors or unexpected query executions related to currency_symbol usage can help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Restrict access to modify the currency_symbol configuration field to trusted administrators only.
- Manually review and sanitize the current value of currency_symbol to remove any injected SQL code.
- Apply input validation and sanitization on the currency_symbol field to prevent injection of malicious SQL expressions.
- If possible, update or patch OpenSourcePOS to a version where this vulnerability is fixed.
- Monitor application logs for suspicious activity related to SQL queries involving currency_symbol.