PT-2026-125495
CVE-2026-116746
·
Published
2026-10-26
·
Updated
2026-10-26
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
QloApps versions 1.6.0 through 1.7.0
Description
An authorization flaw exists in the
AddReview AJAX action within the qlohotelreview module. This allows unauthenticated attackers to submit fake ratings and reviews for arbitrary orders by reusing the publicly exposed review ajax token and enumerating sequential id order values to attribute the reviews to other customers.Recommendations
Update QloApps to a version later than 1.7.0.
Restrict access to the
AddReview AJAX action in the qlohotelreview module to prevent unauthorized submissions.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾