CVE-2025-67325
CriticalSummary
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.
Risk Assessment
The risk includes the possibility of remote code execution by an unauthenticated attacker, which can lead to full compromise of the application and server, data theft, or service disruption.
Recommendation
It is recommended to immediately upgrade QloApps to a version later than 1.7.0 and implement restrictions on file types and sizes for uploads.
Other vulnerabilities in QloApps
See all- CVE-2026-92234Medium
QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child_features parameter.
- CVE-2026-89268Medium
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.
- CVE-2026-25558Medium
QloApps through version 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager. Authenticated administrators can inject malicious JavaScript by uploading crafted SVG files with embedded event handlers such as onload.
- CVE-2026-25861Medium
QloApps through version 1.7.0 uses the weak MD5 algorithm for password hashing in the Tools::encrypt() function. Attackers can perform offline brute-force attacks on these hashes, with the risk compounded by auto-generated 8-character passwords during guest-to-customer conversion.
Original NVD description (English source)
Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achieve remote code execution.