Information Disclosure Vulnerability in Webkul QloApps
CVE-2023-36235

6.5MEDIUM

Key Information:

Vendor

Webkul

Status
Qloapps
Vendor
CVE Published:
17 January 2024

What is CVE-2023-36235?

Webkul QloApps versions prior to 1.6.0 contain a vulnerability that allows unauthorized access to sensitive information through exploitation of the id_order parameter. This issue arises from improper validation of user input, potentially compromising the confidentiality of customer data. Attackers can craft specific requests to retrieve sensitive information, which heightens the risk associated with data privacy and security within the application.

References

https://qloapps.com/
https://github.com/webkul/hotelcommerce/pull/537
https://github.com/Ek-Saini/security/blob/main/IDOR-Qloapps

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-36235 : Information Disclosure Vulnerability in Webkul QloApps