Information Disclosure Vulnerability in Webkul QloApps

CVE-2023-36235

Summary

Webkul QloApps versions prior to 1.6.0 contain a vulnerability that allows unauthorized access to sensitive information through exploitation of the id_order parameter. This issue arises from improper validation of user input, potentially compromising the confidentiality of customer data. Attackers can craft specific requests to retrieve sensitive information, which heightens the risk associated with data privacy and security within the application.

References