PT-2025-5824 · Webkul · Webkul Qloapps

Mahendravarman · Published 2025-02-06 · Updated 2025-07-02 · CVE-2025-1074

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Webkul QloApps version 1.6.1

Description A problematic issue was found in Webkul QloApps, affecting the logout function of the /en/?mylogout file in the URL Handler component. This issue leads to cross-site request forgery and can be exploited remotely. The vendor is aware of the issue and is working on a resolution.

Recommendations For Webkul QloApps version 1.6.1, consider disabling the logout function of the /en/?mylogout file in the URL Handler component as a temporary workaround until a patch is available. Restrict access to the vulnerable URL Handler component to minimize the risk of exploitation. Avoid using the affected logout functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2025-1074

Affected Products

Webkul Qloapps

References · 11

• 🔥 https://github.com/mano257200/qloapps-csrf-logout-vulnerability · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1074 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1074 · Vendor Advisory
• https://vuldb.com/?submit.491600 · Note
• https://t.me/cvedetector/17382 · Telegram Post
• https://vuldb.com/?id.294834 · Note
• https://vuldb.com/?ctiid.294834 · Note
• https://twitter.com/VulmonFeeds/status/1887526928396996924 · Twitter Post
• https://t.me/cvenotify/127481 · Telegram Post
• https://twitter.com/CVEnew/status/1887505190468919360 · Twitter Post
• https://t.me/cvenotify/110230 · Telegram Post