SQL Injection Flaw Found in Open Source Point of Sale

CVE Notify is flagging a critical SQL injection vulnerability, CVE-2026-32888, impacting Open Source Point of Sale (OSPOS), a PHP-based web application built on the CodeIgniter framework. The vulnerability lies within the item search functionality, specifically when the custom attribute search feature (search_custom filter) is active. According to CVE Notify, user input from the search GET parameter is directly inserted into a HAVING clause without proper sanitization or parameterization. This oversight allows an authenticated attacker, even with basic item search privileges, to craft malicious queries and execute arbitrary SQL commands against the database. At the time of the advisory’s publication, a patch was not yet available, leaving instances of OSPOS exposed.

This exploit is particularly concerning because it targets an application handling sensitive sales and inventory data. An attacker could potentially exfiltrate customer information, manipulate sales records, or even compromise the integrity of the entire system. The reliance on unparameterized input in database queries is a classic, yet persistent, coding error that can have devastating consequences.