An insecure direct object reference flaw lets a logged‐in user with low privileges change the password of another account by altering the employee_id field in the request. The application does not verify that the current user owns the target employee record, so the vulnerable code permits modifying another user’s credentials. This weakness allows the attacker to take over that account if the password change succeeds.

The affected system is the Open Source Point of Sale web application written in PHP and built on the CodeIgniter framework. Versions earlier than 3.4.2 contain the flaw. Version 3.4.2 and later add authorization checks that restrict password changes to the owning employee.

The CVSS score of 6.5 indicates moderate severity. Exploitation requires an authenticated session and the ability to manipulate the employee_id parameter, typically through a URL or form submission; the likely attack vector is via the web interface. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so while the probability of active exploitation is uncertain, the impact if successful is significant.