QloApps CVE-2026-75496

Exploitation requires valid QloApps administrative credentials; the CVSS 4.0 PR:H metric confirms high-privilege authentication is a hard prerequisite with no bypass path described. The specific attack surface is the ajaxProcessUploadBookingDocument AJAX endpoint within the admin orders controller, which is only accessible to authenticated administrators - it is not exposed to unauthenticated users or guests. The booking document upload feature must be in use (part of the hotelreservationsystem module); installations that have not deployed or have disabled this module are not affected through this vector. Successful code execution additionally requires the web server to permit PHP execution within the upload destination directory - installations that enforce execution restrictions on upload directories via server configuration would prevent RCE even if an executable file is successfully uploaded. Exploitation is limited by: (1) hard requirement for admin-level authentication, (2) the attack surface being entirely within the admin panel rather than any public-facing endpoint, and (3) server-side PHP execution policy in the upload directory.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately conveys the technical severity while the PR:H metric is the key constraining factor: exploitation is gated behind valid administrative credentials, which limits the realistic exploitable population to credential-compromised admins or malicious insiders. EPSS data was not provided in the intelligence sources; KEV status is not confirmed and no public proof-of-concept exploit has been identified, both of which reduce immediate exploitation pressure. These signals collectively suggest this is not a mass-exploitation candidate in the near term, but the path from admin credential compromise to full server RCE is trivially short and requires no additional vulnerability chaining - making it high priority in any environment where admin account security cannot be guaranteed. The CVSS severity is appropriate rather than inflated; the primary real-world risk reduction lever is ensuring strong admin credential hygiene and MFA on the admin panel rather than deprioritizing the patch.

An attacker who has acquired QloApps administrative credentials - via phishing, credential stuffing against a reused password, or insider access - logs into the admin panel and navigates to the hotel booking document upload interface. The attacker uploads a PHP webshell with a .php extension (or any executable extension), which bypasses the absent server-side validation and is moved to a publicly accessible directory on the web server. The attacker then directly requests the uploaded file's URL via HTTP, triggering execution of arbitrary PHP code under the web server process account.