Qloapps
CVE-2025-67325
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
AnalysisAI
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature. Attackers can achieve immediate remote code execution. PoC available.
Technical ContextAI
The hotel review file upload does not validate file types (CWE-434) and does not require authentication. PHP files uploaded through reviews are web-accessible and execute on the server.
RemediationAI
Update QloApps. Restrict uploads to image-only file types. Move uploads outside the webroot.
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_p
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploadi
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive informat
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remo
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3
Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScrip
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executa
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credenti
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsani
Share
External POC / Exploit Code
Leaving vuln.today