CVE-2023-36288
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Risk Assessment
This vulnerability poses a risk of session hijacking, which could lead to unauthorized access to user accounts and data. Organizations should be aware of the potential consequences related to data security.
Recommendation
It is recommended to update Webkul QloApps to the latest version to mitigate this vulnerability. Additionally, implementing XSS protection mechanisms such as input validation and sanitization is advisable.
Other vulnerabilities in Webkul QloApps 1.6.0
See all- CVE-2026-75498High
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123c97c.
- CVE-2026-75497High
Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c.
- CVE-2026-75496High
Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c.
- CVE-2023-36287Medium
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
- CVE-2023-36284High
An unauthenticated Time-Based SQL injection was found in Webkul QloApps version 1.6.0 via GET parameters date_from, date_to, and id_product. This allows a remote attacker to bypass the web application's authentication and authorization mechanisms and retrieve the contents of an entire database.
- CVE-2023-36289Medium
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie. This enables the attacker to impersonate that user via POST email_create and back parameter.
Original NVD description (English source)
An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS