CVE-2026-75497: Webkul QloApps SQL injection
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Webkul QloAppsto a version that resolves this vulnerability.Fixed in 123c97c
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be remote, authenticated, and have administrative privileges. Exploitation involves sending a crafted SQL query through the bo_query parameter handled by CustomerMessage.php.
What is the potential impact if this vulnerability is exploited?
The vulnerability has high impacts on confidentiality, integrity, and availability. An administrator-level attacker may be able to manipulate database queries through SQL injection.
What remediation is identified?
Apply the fix associated with commit 123c97c. The provided data does not identify a corresponding release or version number.