PT-2023-22606 · Webkil · Webkul Qloapps

Ahrixia · Published 2023-05-11 · Updated 2025-01-27 · CVE-2023-30256

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webkil QloApps version 1.5.2

Description A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via the back and email create parameters in the AuthController.php file.

Recommendations For Webkil QloApps version 1.5.2, consider disabling the back and email create parameters in the AuthController.php file as a temporary workaround until a patch is available. Restrict access to the AuthController.php file to minimize the risk of exploitation. Avoid using the back and email create parameters until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-30256

Affected Products

Webkul Qloapps

References · 10

• 🔥 https://github.com/ahrixia/CVE-2023-30256 · Exploit
• 🔥 https://exploit-db.com/exploits/51465 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-30256 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30256 · Vendor Advisory
• https://github.com/webkul/hotelcommerce · Note
• https://t.me/cvenotify/51070 · Telegram Post
• https://qloapps.com · Note
• https://t.me/cvenotify/50765 · Telegram Post
• http://packetstormsecurity.com/files/172542/Webkul-Qloapps-1.5.2-Cross-Site-Scripting.html · Note
• https://t.me/cvenotify/108696 · Telegram Post