Opensourcepos Open Source Point of Sale Weak Hash Vulnerability in Employee Login Component

A vulnerability exists in opensourcepos Open Source Point of Sale versions prior to 3.4.2, specifically in the Employee Login function within the app/Models/Employee.php file. This flaw allows for the use of a weak password hash, potentially enabling remote exploitation. However, the vulnerability's actual existence is uncertain, as the vendor notes that the old hash function is still present to support the upgrade path, with default passwords initially using the old hash but migrating to a newer one after login.

Impact

Exploitation of this vulnerability could lead to the use of weak password hashes, potentially allowing for easier password cracking or unauthorized access.