SQL Injection Vulnerability in Open Source Point of Sale by Open Source Point of Sale

CVE-2026-32888

What is CVE-2026-32888?

The Open Source Point of Sale application, built on the CodeIgniter framework, is vulnerable to SQL injection through its Items search functionality. When the custom attribute search feature is activated, user input provided via the search GET parameter is directly interpolated into a HAVING clause without any form of parameterization or sanitization. This vulnerability could allow an authenticated attacker, possessing basic search permissions, to execute arbitrary SQL queries and potentially access sensitive data. At the time of publication, no patch was available to address this issue.

References