Executive brief
Webkul QloApps is an e-commerce platform used to manage online stores. An authenticated administrator can exploit a SQL injection vulnerability in the CustomerMessage module to execute arbitrary SQL queries and access or modify the database. This could lead to unauthorized access to sensitive business data, including customer information and transactional records.
Technical details
The vulnerability is a SQL injection (SQLi) flaw in the CustomerMessage.php file where request parameters (specifically the 'bo_query' parameter) are not properly validated before being used in a database query. An attacker with administrative privileges can craft a malicious SQL query and send it through this parameter to bypass input validation and execute arbitrary SQL commands. The attack requires authentication as an administrator and network access to the application. Successful exploitation allows an attacker to read, modify, or delete database records. A patch is available in commit 123c97c.
Affected products
- Webkul QloApps before commit 123c97c
Timeline
- 2026-08-25: disclosed
- 2026-07-14: patched: Fixed in commit 123c97c
- 2026-08-25: advisory: CISA VA-26-237-01 published