Leediay153

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.

**Name of the Vulnerable Software and Affected Versions** Webkul QloApps (affected versions not specified) **Description** Improper validation of uploaded file extensions or MIME types allows a remote, authenticated attacker with administrative privileges to upload executable files to a publicly accessible directory, leading to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webkul QloApps (affected versions not specified) **Description** An issue exists where request parameters are not validated before being used in a database query. A remote, authenticated attacker with administrative privileges can execute a crafted SQL query via the `bo query` parameter in the 'CustomerMessage.php' file. SQL Injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** Apply the fix implemented in commit 123c97c. As a temporary mitigation, restrict administrative access to the 'CustomerMessage.php' file.

**Name of the Vulnerable Software and Affected Versions** Webkul QloApps (affected versions not specified) **Description** An authenticated remote attacker with administrative privileges can execute a SQL injection attack. This occurs because the application fails to validate request parameters before performing a database query. The issue is located in the `Address.php` file via the `bo query` parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.