CVE-2026-116746: QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed reviewajaxtoken and enumerate sequential idorder values to post fake ratings and reviews attributed to other customers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No account or user interaction is required, provided the attacker can access the review submission functionality and its publicly exposed review_ajax_token.
What does an attacker need to submit a fraudulent review?
The attacker needs the exposed review_ajax_token and an id_order value. Because order IDs can be enumerated sequentially, attackers can target arbitrary orders and submit ratings or review text attributed to other customers.
What is the practical impact?
The issue affects the integrity of hotel reviews rather than confidentiality or availability. An attacker can create fake reviews and ratings associated with legitimate customers' orders.
How can I determine whether my deployment is affected?
Deployments running QloApps versions 1.6.0 through 1.7.0 are affected. Review submitted hotel reviews for unexpected content or ratings associated with customer orders, particularly where the customer did not submit the review.