QloApps CVE-2026-25861

Exploitation requires the attacker to first obtain QloApps password hashes from the database (via prior SQLi, backup exposure, host compromise, or insider access) and to know or recover the site-specific static cookie key concatenated by Tools::encrypt() in classes/Tools.php; without the hash material the MD5 weakness alone is not directly reachable over the network despite the CVSS AV:N rating, which is reflected in AC:H. The impact is amplified specifically against accounts created through the guest-to-customer conversion path in classes/Customer.php::transformToCustomer(), which assigns 8-character auto-generated passwords that fall to offline brute-force trivially; manually chosen long passphrases remain comparatively expensive to crack. The vulnerability affects QloApps up to 1.7.0 in default configuration - no non-default feature toggle is required, and no user interaction or authentication is needed for the offline cracking step itself.

CVSS 4.0 scores this 8.2 (High) with vector AV:N/AC:H/PR:N/UI:N and VC:H/VI:N/VA:N - confidentiality-only impact reflecting that the bug yields credentials rather than direct code execution, and AC:H acknowledges the attacker must first obtain the password database (e.g., via SQLi, backup leak, or insider access) before the MD5 weakness becomes useful. There is no EPSS score, SSVC decision, or KEV listing in the provided data, and no public PoC is referenced; VulnCheck disclosed the issue and the patch is already merged, indicating coordinated disclosure rather than active exploitation. Practical risk concentrates on deployments that have already suffered a database exposure or that re-use the same cookie key across instances, where the auto-generated 8-character guest-conversion passwords would fall to GPU brute-force within minutes. CVSS network vector should not be over-read: exploitation is offline post-compromise, so prioritization should be tied to the likelihood of database disclosure in a given environment rather than treating this as a remotely triggerable RCE.

An attacker who obtains a copy of a QloApps database - for example via a separate SQL injection, a leaked backup, or insider access - extracts the passwd columns from ps_customer and ps_employee and runs hashcat against the MD5(cookie_key||password) construction using a leaked or recovered cookie key. Because guest-converted accounts use only 8-character auto-generated passwords, exhaustive search over that keyspace recovers cleartext credentials in minutes on commodity GPUs, which the attacker then replays against the storefront and admin panel, and likely against other sites where customers reused the password. No public exploit identified at time of analysis, but the cracking workflow is standard and the patch diff makes the vulnerable construction explicit.