PT-2023-22606 · Webkil · Webkul Qloapps

Ahrixia · Publicado 2023-05-11 · Atualizado 2025-01-27 · CVE-2023-30256

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webkil QloApps version 1.5.2

Description A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via the back and email create parameters in the AuthController.php file.

Recommendations For Webkil QloApps version 1.5.2, consider disabling the back and email create parameters in the AuthController.php file as a temporary workaround until a patch is available. Restrict access to the AuthController.php file to minimize the risk of exploitation. Avoid using the back and email create parameters until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-30256

Produtos afetados

Webkul Qloapps

Referências · 10

• 🔥 https://github.com/ahrixia/CVE-2023-30256 · Exploit
• 🔥 https://exploit-db.com/exploits/51465 · Exploit
• https://github.com/webkul/hotelcommerce · Nota
• https://t.me/cvenotify/51070 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30256 · Nota de Segurança
• https://qloapps.com · Nota
• https://t.me/cvenotify/50765 · Publicação no Telegram
• http://packetstormsecurity.com/files/172542/Webkul-Qloapps-1.5.2-Cross-Site-Scripting.html · Nota
• https://osv.dev/vulnerability/CVE-2023-30256 · Aviso do Fabricante
• https://t.me/cvenotify/108696 · Publicação no Telegram