OpenSourcePOS version 3.4.1 contains a second‑order SQL injection vulnerability in the handling of the currency_symbol configuration field. The input is stored as entered and later concatenated into a dynamically constructed SQL query without sanitization or parameter binding. This flaw allows an attacker who can modify the currency_symbol value to inject arbitrary SQL expressions that are executed when the query is processed, potentially exposing or altering sensitive data. The weakness is identified as CWE‑89.

The affected software is OpenSourcePOS, an open‑source point‑of‑sale application, specifically version 3.4.1 No other vendors or products are listed as impacted.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits are documented. Exploitation requires the attacker to have permissions to modify the currency_symbol setting, typically through administrative access to the application shell or configuration interface. The likely attack vector is a privileged user changing the configuration, and based on the description, it is inferred that once that access is achieved the attacker can execute arbitrary SQL commands, compromising database confidentiality and integrity.