EUVD-2026-34042
GHSA-xcxp-3whg-h83c
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.
AnalysisAI
Weak password hashing in QloApps through 1.7.0 enables credential compromise because Tools::encrypt() in classes/Tools.php hashes passwords with unsalted MD5 concatenated with a static cookie key, allowing offline brute-force recovery of customer and employee credentials. The risk is amplified by an 8-character auto-generated password used during guest-to-customer conversion in classes/Customer.php, making cracked hashes practically trivial. No public exploit identified at time of analysis, but the upstream fix in commit 64e9722 replaces MD5 with the PasswordHashing class for credential storage.
Technical ContextAI
QloApps is a PHP-based open-source hotel reservation and booking management platform forked from PrestaShop. The flaw maps to CWE-916 (Use of Password Hash With Insufficient Computational Effort): Tools::encrypt() composes a hash as MD5(static_cookie_key || password), a fast, GPU-friendly algorithm with no per-user salt and no key-stretching, so identical passwords across users produce identical hashes once the global cookie key is known or recovered. The PR diff (Qloapps/QloApps#1689) shows the fix migrates customer and employee password columns from size 32 (MD5 hex) to size 60 (bcrypt-style) and routes hashing through a new PasswordHashing class with validateHash() and isPrimaryHash() so legacy hashes are transparently upgraded on next successful login. The CPE cpe:2.3:a:qloapps:qloapps:*:*:*:*:*:*:*:* covers all versions up to and including 1.7.0.
RemediationAI
Upstream fix available (commit 64e9722); a released patched version is not independently confirmed in the provided data, so operators should pull commit 64e9722e7e6a8fda77dd53964d988fb6b5c3d174 from the Qloapps/QloApps repository or the next tagged release after 1.7.0 that includes PR #1689. After upgrading, force a password reset for all customer and employee accounts so legacy MD5 hashes are replaced with bcrypt-style PasswordHashing entries rather than waiting for the in-code lazy rehash on next login, and rotate the static cookie key referenced by Tools::encrypt() to invalidate any previously exfiltrated hashes. If immediate patching is not possible, compensating controls include restricting database access (network ACLs, least-privilege DB users, encrypted backups) to prevent the hash exfiltration that this bug presupposes, disabling or auditing the guest-to-customer conversion flow in classes/Customer.php to eliminate the 8-character auto-generated passwords (trade-off: friction for returning guests), and enforcing strong customer/admin password policies plus MFA on the back office; none of these substitute for upgrading. Reference the VulnCheck advisory at https://www.vulncheck.com/advisories/qloapps-weak-password-hashing-via-md5-in-tools-php for vendor guidance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today