Qloapps
Monthly
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Weak password hashing in QloApps through 1.7.0 enables credential compromise because Tools::encrypt() in classes/Tools.php hashes passwords with unsalted MD5 concatenated with a static cookie key, allowing offline brute-force recovery of customer and employee credentials. The risk is amplified by an 8-character auto-generated password used during guest-to-customer conversion in classes/Customer.php, making cracked hashes practically trivial. No public exploit identified at time of analysis, but the upstream fix in commit 64e9722 replaces MD5 with the PasswordHashing class for credential storage.
Insecure direct object reference in QloApps through 1.7.0 lets an authenticated, hotel-restricted back-office employee manipulate sequential identifiers to act on resources belonging to other hotels - reading, uploading and deleting booking documents, deleting rooms, room images, room-type product images and hotel images. The flaw is exploitable only in multi-hotel installations that actually use per-hotel scoping via htl_access, and only by a user who already holds a valid low-privilege back-office account (CVSS vector PR:L, so authenticated rather than unauthenticated); a single-hotel deployment or a deployment without hotel-restricted profiles is not meaningfully exposed. Exploitation is a low-severity-to-moderate integrity and confidentiality problem across tenant boundaries rather than an emergency remote compromise: no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), and the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is consistent with a medium-severity insider authorization issue. Vendor-side fixes exist upstream (PR #1922 and commit 83eb851) but a tagged patched release was not independently confirmed from the supplied data.
Hotel-restricted back-office employees in QloApps through 1.7.0 can modify room records belonging to hotels they are not authorized to manage, because AdminProductsController::ajaxProcessBulkUpdateRooms trusts the client-supplied id_rooms parameter without verifying that those rooms belong to hotels the employee's profile can access. An authenticated low-privileged employee submitting foreign room IDs can change room status, floor, comments, or inactive dates, disrupting availability and bookings at other properties. Rated 5.3, this is a moderate-severity cross-tenant IDOR (CWE-639) that is meaningful only in multi-hotel deployments with non-super-admin, hotel-restricted staff accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix is available in GitHub PR #1892.
Reflected cross-site scripting in the QloApps back-office (through version 1.7.0) allows an attacker to execute arbitrary JavaScript inside an authenticated administrator's browser session by inducing that admin to submit a crafted POST request to the room type editor's length-of-stay configuration. The payload is injected through the restriction_min_los and restriction_max_los parameters, which are echoed unescaped into HTML input value attributes in admin/themes/default/template/controllers/products/lengthofstay.tpl. Exploitation requires an authenticated back-office session (CVSS vector PR:L) plus administrator interaction (UI:P), so it is a social-engineering-dependent, admin-only reflected XSS rather than a passively triggered or remotely reachable flaw; no public exploit code or active exploitation was identified at time of analysis, though a technical writeup is publicly available. The vendor-supplied CVSS 4.0 score of 5.1 is modest and consistent with the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Reflected cross-site scripting in the QloApps back-office room type editor (all versions through 1.7.0) allows an attacker to execute arbitrary JavaScript in a logged-in administrator's session by inducing that administrator to submit a crafted POST request whose room_num, floor, or comment values are reflected unescaped into HTML input attributes. Exploitation is not self-triggering: it requires an authenticated back-office user and active user interaction, so the practical risk is moderate-to-low despite the administrative context, and each attempt needs a fresh lure because the XSS is non-persistent. No public exploit identified at time of analysis, and an upstream fix is available via the vendor's GitHub pull request and commit, though a tagged patched release version is not independently confirmed.
Reflected cross-site scripting (CWE-79) in QloApps through 1.7.0 lets attackers inject JavaScript through the 'exceptions' parameter of the back-office 'Transplant a module' form, which AdminModulesPositionsController::displayModuleExceptionList() reflects unescaped into an HTML input so the payload executes in an authenticated administrator's browser once the victim follows a crafted link. Exploitation requires a logged-in back-office admin and victim interaction (CVSS 4.0 5.1 Medium; vector PR:L/UI:P, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the payload is reflected and non-persistent so each victim must be individually lured, and impact is bounded to low confidentiality/integrity with no availability effect. An upstream fix is available (GitHub PR #1899 / commit 7ed467d, which introduces Tools::safeOutput), and no public exploit is identified at time of analysis.
Reflected cross-site scripting in QloApps 1.7.0 and earlier lets remote attackers inject JavaScript through the date_to and id_room_type parameters of the back-office Hotel Reservation System 'Book Now' search, which executes in the browser of an authenticated administrator who follows a crafted link. Exploitation requires a logged-in back-office administrator (PR:L) and user interaction (UI:R) - the payload is reflected, not stored, so it does not self-propagate and depends on social engineering of a privileged user, which meaningfully constrains real-world impact. This is a genuine but modest-severity issue, not a top-tier priority; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), though public technical write-ups describing the bug exist.
Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScript into the application by uploading SVG files containing malicious event handlers (e.g., onload) via the admin file manager. Any user who subsequently views the uploaded file triggers the embedded script in their browser, crossing a security boundary (S:C) from the admin upload context into arbitrary victim sessions. Publicly available exploit code exists per VulnCheck and a linked GitHub issue; no active exploitation has been confirmed by CISA KEV.
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. [CVSS 5.4 MEDIUM]
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature. Attackers can achieve immediate remote code execution. PoC available.
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in QloApps 1.6.1 admin panel allows authenticated administrators to inject SQL via the packItself parameter in /admin/ajax_products_list.php, potentially leading to unauthorized data access or manipulation. Although the exploit is publicly available, exploitation requires high privileges, and the vendor considers it low severity. The vulnerability is not currently in CISA KEV and has a low EPSS probability.
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in QloApps through 1.7.0 lets an authenticated back-office user read arbitrary files from the web server by supplying directory-traversal sequences in the 'email' parameter of the getEmailHTML action in admin/ajax.php. Because the vulnerable code passes an attacker-controlled path to file_get_contents without verifying it stays inside the mail template directory, stolen files can include configuration and database-credential material, giving a limited-privilege admin user read access to data far beyond their intended scope. Publicly available exploit code exists (a detailed write-up is referenced), but there is no evidence of confirmed active exploitation in the wild; the vendor fix is available upstream as PR #1719 / commit 8015495c, so exposure is realistically limited to unpatched installations.
SQL injection in Webkul QloApps back-office address search allows a remote attacker holding valid administrator credentials to execute arbitrary SQL via the unsanitized 'bo_query' parameter passed to the 'searchByName()' method in 'Address.php'. The scope of the patch (commit 123c97c, PR #1783) reveals the flaw spans at least five PHP files - including 'CustomerMessage.php' and three hotel reservation module classes - each inserting raw user input directly into LIKE or IN SQL clauses without using QloApps' own 'pSQL()' sanitization or integer casting. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
SQL injection in Webkul QloApps exposes the entire database to remote authenticated administrators who can supply unsanitized input to the 'bo_query' parameter in the back-office search interface. The patch diff reveals the flaw extends beyond CustomerMessage.php to Address.php and multiple hotel reservation system modules (HotelBranchRefundRules, HotelRoomTypeFeaturePricing, HotelRoomTypeGlobalDemandAdvanceOption), all of which concatenated user-supplied strings directly into SQL queries without pSQL() sanitization or integer casting. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data was not provided in the source intelligence.
Unrestricted file upload in Webkul QloApps allows a remote attacker holding administrative credentials to upload executable files - including PHP webshells - to a publicly accessible server directory and achieve full server-side remote code execution. The booking document upload workflow in the hotel reservation module failed to validate file extensions or inspect MIME types server-side, trusting client-supplied metadata entirely. Upstream fix commit 153ec1c is available via GitHub PR #1801; no public exploit code or CISA KEV listing has been identified at time of analysis.
Weak password hashing in QloApps through 1.7.0 enables credential compromise because Tools::encrypt() in classes/Tools.php hashes passwords with unsalted MD5 concatenated with a static cookie key, allowing offline brute-force recovery of customer and employee credentials. The risk is amplified by an 8-character auto-generated password used during guest-to-customer conversion in classes/Customer.php, making cracked hashes practically trivial. No public exploit identified at time of analysis, but the upstream fix in commit 64e9722 replaces MD5 with the PasswordHashing class for credential storage.
Insecure direct object reference in QloApps through 1.7.0 lets an authenticated, hotel-restricted back-office employee manipulate sequential identifiers to act on resources belonging to other hotels - reading, uploading and deleting booking documents, deleting rooms, room images, room-type product images and hotel images. The flaw is exploitable only in multi-hotel installations that actually use per-hotel scoping via htl_access, and only by a user who already holds a valid low-privilege back-office account (CVSS vector PR:L, so authenticated rather than unauthenticated); a single-hotel deployment or a deployment without hotel-restricted profiles is not meaningfully exposed. Exploitation is a low-severity-to-moderate integrity and confidentiality problem across tenant boundaries rather than an emergency remote compromise: no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), and the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is consistent with a medium-severity insider authorization issue. Vendor-side fixes exist upstream (PR #1922 and commit 83eb851) but a tagged patched release was not independently confirmed from the supplied data.
Hotel-restricted back-office employees in QloApps through 1.7.0 can modify room records belonging to hotels they are not authorized to manage, because AdminProductsController::ajaxProcessBulkUpdateRooms trusts the client-supplied id_rooms parameter without verifying that those rooms belong to hotels the employee's profile can access. An authenticated low-privileged employee submitting foreign room IDs can change room status, floor, comments, or inactive dates, disrupting availability and bookings at other properties. Rated 5.3, this is a moderate-severity cross-tenant IDOR (CWE-639) that is meaningful only in multi-hotel deployments with non-super-admin, hotel-restricted staff accounts; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix is available in GitHub PR #1892.
Reflected cross-site scripting in the QloApps back-office (through version 1.7.0) allows an attacker to execute arbitrary JavaScript inside an authenticated administrator's browser session by inducing that admin to submit a crafted POST request to the room type editor's length-of-stay configuration. The payload is injected through the restriction_min_los and restriction_max_los parameters, which are echoed unescaped into HTML input value attributes in admin/themes/default/template/controllers/products/lengthofstay.tpl. Exploitation requires an authenticated back-office session (CVSS vector PR:L) plus administrator interaction (UI:P), so it is a social-engineering-dependent, admin-only reflected XSS rather than a passively triggered or remotely reachable flaw; no public exploit code or active exploitation was identified at time of analysis, though a technical writeup is publicly available. The vendor-supplied CVSS 4.0 score of 5.1 is modest and consistent with the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Reflected cross-site scripting in the QloApps back-office room type editor (all versions through 1.7.0) allows an attacker to execute arbitrary JavaScript in a logged-in administrator's session by inducing that administrator to submit a crafted POST request whose room_num, floor, or comment values are reflected unescaped into HTML input attributes. Exploitation is not self-triggering: it requires an authenticated back-office user and active user interaction, so the practical risk is moderate-to-low despite the administrative context, and each attempt needs a fresh lure because the XSS is non-persistent. No public exploit identified at time of analysis, and an upstream fix is available via the vendor's GitHub pull request and commit, though a tagged patched release version is not independently confirmed.
Reflected cross-site scripting (CWE-79) in QloApps through 1.7.0 lets attackers inject JavaScript through the 'exceptions' parameter of the back-office 'Transplant a module' form, which AdminModulesPositionsController::displayModuleExceptionList() reflects unescaped into an HTML input so the payload executes in an authenticated administrator's browser once the victim follows a crafted link. Exploitation requires a logged-in back-office admin and victim interaction (CVSS 4.0 5.1 Medium; vector PR:L/UI:P, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the payload is reflected and non-persistent so each victim must be individually lured, and impact is bounded to low confidentiality/integrity with no availability effect. An upstream fix is available (GitHub PR #1899 / commit 7ed467d, which introduces Tools::safeOutput), and no public exploit is identified at time of analysis.
Reflected cross-site scripting in QloApps 1.7.0 and earlier lets remote attackers inject JavaScript through the date_to and id_room_type parameters of the back-office Hotel Reservation System 'Book Now' search, which executes in the browser of an authenticated administrator who follows a crafted link. Exploitation requires a logged-in back-office administrator (PR:L) and user interaction (UI:R) - the payload is reflected, not stored, so it does not self-propagate and depends on social engineering of a privileged user, which meaningfully constrains real-world impact. This is a genuine but modest-severity issue, not a top-tier priority; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), though public technical write-ups describing the bug exist.
Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in QloApps through 1.7.0 enables authenticated administrators to inject persistent JavaScript into the application by uploading SVG files containing malicious event handlers (e.g., onload) via the admin file manager. Any user who subsequently views the uploaded file triggers the embedded script in their browser, crossing a security boundary (S:C) from the admin upload context into arbitrary victim sessions. Publicly available exploit code exists per VulnCheck and a linked GitHub issue; no active exploitation has been confirmed by CISA KEV.
A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. [CVSS 5.4 MEDIUM]
QloApps hotel management system (through 1.7.0) allows unauthenticated web shell upload through the hotel review feature. Attackers can achieve immediate remote code execution. PoC available.
A vulnerability was detected in Webkul QloApps up to 1.7.0. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in QloApps 1.6.1 admin panel allows authenticated administrators to inject SQL via the packItself parameter in /admin/ajax_products_list.php, potentially leading to unauthorized data access or manipulation. Although the exploit is publicly available, exploitation requires high privileges, and the vendor considers it low severity. The vulnerability is not currently in CISA KEV and has a low EPSS probability.
Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.